@capxul/cli 4.20.0-beta.27 → 4.20.0-beta.28

package/dist/{entry-GLdITgH4.mjs → entry-DXu0dr0S.mjs}

@@ -1,5 +1,5 @@
 import { i as __exportAll, o as __require, r as __commonJSMin, s as __toESM } from "./lib-DnmstTkB.mjs";
-import { A as assertSize, B as pad, C as keccak256$1, D as createCursor, E as toRlp, F as boolToHex, G as IntegerOutOfRangeError, H as trim$1, I as bytesToHex, K as InvalidBytesBooleanError, L as numberToHex, M as hexToNumber, N as hexToBytes, O as concat$1, P as toBytes$1, R as stringToHex, S as getAddress$1, T as format, U as size, V as padHex, W as isHex$1, _ as readField, a as ENVIRONMENT_NAMES, b as isAddress$1, d as explicitOrganization$2, f as flagValue, g as isRecord, h as parseWhere, j as hexToBigInt, k as concatHex, l as describeWhere, m as networkName, n as styleFor, o as STAGING_ORIGIN, p as flagValues, q as BaseError$1, r as whoamiLines, s as chooseEnvironment, t as headerLine, u as environmentOf, v as slice, w as InvalidAddressError, x as checksumAddress, y as sliceBytes, z as toHex } from "./where-view-Csv4lEES.mjs";
+import { A as concatHex, B as toHex, C as getAddress$1, D as toRlp, E as format, F as toBytes$1, G as isHex$1, H as padHex, I as boolToHex, J as BaseError$1, K as IntegerOutOfRangeError, L as bytesToHex, M as hexToBigInt, N as hexToNumber, O as createCursor, P as hexToBytes, R as numberToHex, S as checksumAddress, T as InvalidAddressError, U as trim$1, V as pad, W as size, _ as isRecord, a as ENVIRONMENT_NAMES, b as sliceBytes, d as explicitOrganization$2, f as flagValue, g as scopeArgs, h as parseWhere, j as assertSize, k as concat$1, l as describeWhere, m as networkName, n as styleFor, o as STAGING_ORIGIN, p as flagValues, q as InvalidBytesBooleanError, r as whoamiLines, s as chooseEnvironment, t as headerLine, u as environmentOf, v as readField, w as keccak256$1, x as isAddress$1, y as slice, z as stringToHex } from "./where-view-BJmsAHQb.mjs";
 import { t as require_lib } from "./lib-CoGPQsbr.mjs";
 import process$1, { arch, platform } from "node:process";
 import { fileURLToPath } from "node:url";
@@ -7,8 +7,7 @@ import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpat
 import { basename, dirname, join, resolve } from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Cause, Clock, Config, Console, Context, Crypto, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, FileSystem, Layer, LogLevel, Logger, Metric, Option, Path, Predicate, Queue, Redacted, Ref, References, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Sink, Stdio, Stream, Terminal, Tracer } from "effect";
-import { Argument, CliConfig, CliError, CliOutput, Command, Flag, GlobalFlag, Primitive, Prompt } from "effect/cli";
-import { FetchHttpClient, Headers, HttpBody, HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse } from "effect/http";
+import { Argument, CliConfig, CliError, CliOutput, Command, Flag, GlobalFlag, Param, Primitive, Prompt } from "effect/cli";
 import http from "http";
 import https from "https";
 import zlib from "zlib";
@@ -19,6 +18,7 @@ import url from "url";
 import util from "util";
 import { resolve as resolve$1 } from "path";
 import http2 from "http2";
+import { FetchHttpClient, Headers, HttpBody, HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse } from "effect/http";
 import { OtlpExporter, OtlpLogger, OtlpMetrics, OtlpSerialization, OtlpTracer } from "effect/observability";
 import { createServer } from "node:http";
 import { execFile, spawn } from "node:child_process";
@@ -1936,6 +1936,53 @@ function formatUnits(value, decimals) {
 	return format(value, decimals);
 }
 //#endregion
+//#region src/runtime/format.ts
+const jsonFlag = Flag.Boolean("json").pipe(Flag.withDefault(false), Flag.withDescription("Print a versioned JSON result"));
+const JsonOutput = GlobalFlag.Setting("json")({ flag: jsonFlag });
+/** `--org <handle>` for one command. Commands resolve it through `#auth/actor`. */
+const OrganizationFlag = GlobalFlag.Setting("org")({ flag: Flag.String("org").pipe(Flag.withMetavar("<handle>"), Flag.withDescription("act as this organization for one command"), Flag.optional) });
+/** `--fields <a,b>`: the JSON result keeps only these fields of `data`. */
+const FieldsFlag = GlobalFlag.Setting("fields")({ flag: Flag.String("fields").pipe(Flag.withMetavar("<a,b>"), Flag.withDescription("choose which JSON fields come back"), Flag.optional) });
+/** `--env <name>` for one command. The runner reads it with the other environment sources. */
+const EnvironmentFlag = GlobalFlag.Setting("env")({ flag: Flag.String("env").pipe(Flag.withMetavar("<name>"), Flag.withDescription("use this environment for one command"), Flag.optional) });
+/** What the flags many commands share say in `--help` and `capxul schema`, in one voice. */
+const FLAG_HELP = {
+	email: "the signed-in person to use, when this machine has several",
+	confirm: "make the change without asking; scripts must pass it for each write",
+	input: "the JSON input, from a file or - for stdin",
+	requestKey: "a key that makes repeating the same write safe",
+	timeout: "give up after this many seconds, 1 to 3600 (default 120)"
+};
+/** Local diagnostics require an explicit debug level. */
+const localDiagnosticsEnabled = (args) => {
+	const terminator = args.indexOf("--");
+	const flags = terminator < 0 ? args : args.slice(0, terminator);
+	let level;
+	for (const [index, arg] of flags.entries()) if (arg.startsWith("--log-level=")) level = arg.slice(12);
+	else if (arg.startsWith("--logLevel=")) level = arg.slice(11);
+	else if (arg === "--log-level" || arg === "--logLevel") level = flags[index + 1];
+	return level === "debug";
+};
+/** Negotiate only the global format before native CLI error rendering.
+* Native Flag decoding remains the value authority; the command runner parses everything else.
+*/
+const outputMode = (args) => Effect.gen(function* () {
+	const terminator = args.indexOf("--");
+	const flags = terminator < 0 ? args : args.slice(0, terminator);
+	const values = [];
+	for (const [index, arg] of flags.entries()) if (arg === "--no-json") values.push("false");
+	else if (arg.startsWith("--json=")) values.push(arg.slice(7));
+	else if (arg === "--json") {
+		const next = flags[index + 1];
+		const value = next === void 0 ? "true" : yield* Primitive.Boolean.parse(next).pipe(Effect.as(next), Effect.orElseSucceed(() => "true"));
+		values.push(value);
+	}
+	return yield* jsonFlag.parse({
+		flags: { json: values },
+		arguments: []
+	}).pipe(Effect.map(([, json]) => json ? "json" : "human"), Effect.orElseSucceed(() => values.includes("true") ? "json" : "human"));
+});
+//#endregion
 //#region ../../node_modules/.pnpm/convex@1.39.1_react@19.2.7/node_modules/convex/dist/esm/values/base64.js
 var lookup = [];
 var revLookup = [];
@@ -2744,6 +2791,9 @@ function toCurrencyCode(raw) {
 	if (!isCurrencyCode(raw)) throw Errors.invalidInput("currencyCode", invalidValueReason("unsupported currency", raw));
 	return raw;
 }
+function currencySymbolFor(code) {
+	return CURRENCY_SYMBOLS[code];
+}
 const MAJOR_UNITS_RE = /^[0-9]+(?:\.[0-9]+)?$/;
 const MAX_UINT256 = 2n ** 256n;
 /**
@@ -5033,7 +5083,7 @@ faucetMint: Operation.action("accounts.grants.faucetMint", {
 	]
 }) };
 /** Every approval call: the record is not the signed-in person's, or there is none. */
-const APPROVAL$1 = ["ROLE_PERMISSION_DENIED"];
+const APPROVAL$2 = ["ROLE_PERMISSION_DENIED"];
 /**
 * A prepared money action waits here for the person to sign it with their own
 * key, on the approval page. The backend never signs: it records the person's
@@ -5058,7 +5108,7 @@ const approvals = {
 		errors: [
 			...CALL$10,
 			...DEFECTS,
-			...APPROVAL$1
+			...APPROVAL$2
 		]
 	}),
 	/** The person opened the approval page: stamp the first review of a pending approval. */
@@ -5068,7 +5118,7 @@ const approvals = {
 		errors: [
 			...CALL$10,
 			...DEFECTS,
-			...APPROVAL$1
+			...APPROVAL$2
 		]
 	}),
 	/**
@@ -5084,7 +5134,7 @@ const approvals = {
 		errors: [
 			...CALL$10,
 			...DEFECTS,
-			...APPROVAL$1,
+			...APPROVAL$2,
 			"WRONG_STATE"
 		]
 	}),
@@ -5095,7 +5145,7 @@ const approvals = {
 		errors: [
 			...CALL$10,
 			...DEFECTS,
-			...APPROVAL$1,
+			...APPROVAL$2,
 			"WRONG_STATE"
 		]
 	}),
@@ -5106,7 +5156,7 @@ const approvals = {
 		errors: [
 			...CALL$10,
 			...DEFECTS,
-			...APPROVAL$1,
+			...APPROVAL$2,
 			"WRONG_STATE"
 		]
 	})
@@ -5576,6 +5626,28 @@ const probes = {
 	})
 };
 //#endregion
+//#region ../../packages/protocol/src/evm/role-dsl.ts
+const ORG_BUDGET_ACTIONS = [
+	"send",
+	"sendBatch",
+	"createCommitment"
+];
+/**
+* How a capped Budget's allowance refills (#2298). `monthly` refills the
+* allowance to its cap every 30 days. Roles v2 counts fixed periods from the
+* moment the allowance is set; it has no calendar month. Absent means `none`:
+* the cap is one pot that spending drains for good.
+*/
+const ORG_BUDGET_REFILLS = ["monthly", "none"];
+/** The fixed Roles v2 refill period of a `monthly` Budget: 30 days, in seconds. */
+const MONTHLY_REFILL_PERIOD_SECONDS = 30n * 24n * 60n * 60n;
+/** Derive the Zodiac substrate key for one durable Permission identity. */
+function roleKeyForPermission(permissionId) {
+	const normalized = permissionId.trim();
+	if (normalized.length === 0 || normalized !== permissionId) throw Errors.invalidInput("permissionId", "must be a non-empty canonical Permission ID");
+	return keccak256$1(toBytes$1(`permission ${permissionId}`));
+}
+//#endregion
 //#region ../../packages/protocol/src/permissions/permission-schema.ts
 /**
 * One stored `setAllowance` call inside a command's expected authority set.
@@ -5614,12 +5686,19 @@ const BudgetScopeSchema = Schema.Struct({
 	})]),
 	actions: Schema.NonEmptyArray(Schema.Literals(["pay", "commitments"]))
 }).pipe(Schema.refine((scope) => new Set(scope.actions).size === scope.actions.length && (scope.recipients.type === "anyone" || scope.recipients.accounts.length >= 1 && scope.recipients.accounts.length <= 32 && new Set(scope.recipients.accounts).size === scope.recipients.accounts.length), { message: "Budget scope requires unique actions and one to 32 unique allowed Accounts" }));
+/**
+* How a capped Budget refills (#2298): `monthly` tops the cap back up every 30
+* days (a fixed Roles v2 period, not a calendar month); `none` never refills.
+* Absent means `none`, and writers store only `monthly`.
+*/
+const BudgetRefillSchema = Schema.Literals(ORG_BUDGET_REFILLS);
 /** The accepted product policy stored with one Permission revision. */
 const CurrentPolicySchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: Schema.NullOr(Schema.String),
-	scope: BudgetScopeSchema
+	scope: BudgetScopeSchema,
+	refill: Schema.optional(BudgetRefillSchema)
 }), Schema.Struct({ type: Schema.Literal("managePeople") })]);
 const BudgetIntentSchema = CurrentPolicySchema.pipe(Schema.refine((value) => {
 	if (value.type !== "budget") return false;
@@ -5684,7 +5763,8 @@ const ResolvedPermissionBudgetPolicySchema = Schema.Struct({
 		"send",
 		"sendBatch",
 		"createCommitment"
-	]))
+	])),
+	refill: Schema.optional(BudgetRefillSchema)
 });
 const PermissionRecipientBindingSchema = Schema.Struct({
 	accountId: AccountIdSchema$1,
@@ -5696,16 +5776,22 @@ const StoredPermissionIntentSchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: Schema.NullOr(AssetAmountSchema),
-	scope: Schema.optional(BudgetScopeSchema)
+	scope: Schema.optional(BudgetScopeSchema),
+	refill: Schema.optional(BudgetRefillSchema)
 }).pipe(Schema.refine((intent) => intent.limit === null || intent.limit.asset === intent.asset, { message: "Budget limit must use the Budget asset" })), Schema.Struct({ type: Schema.Literal("managePeople") })]);
 /** Writes state every granted right and use a finite positive AssetAmount cap. */
 const PermissionIntentSchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: AssetAmountSchema,
-	scope: BudgetScopeSchema
+	scope: BudgetScopeSchema,
+	refill: Schema.optional(BudgetRefillSchema)
 }).pipe(Schema.refine((intent) => intent.limit.asset === intent.asset && /[1-9]/u.test(intent.limit.value), { message: "Budget cap must be positive and use the Budget asset" })), Schema.Struct({ type: Schema.Literal("managePeople") })]);
-/** Decode once and give set-like scope fields one stable command representation. */
+/**
+* Decode once and give set-like scope fields one stable command representation.
+* An explicit `refill: "none"` is kept: on a change it turns a refill off,
+* where a missing `refill` keeps the Budget's current one (`keepRefillOnChange`).
+*/
 function decodePermissionIntent$1(input) {
 	const intent = Schema.decodeUnknownSync(PermissionIntentSchema, { onExcessProperty: "error" })(input);
 	if (intent.type === "managePeople") return intent;
@@ -5720,6 +5806,19 @@ function decodePermissionIntent$1(input) {
 		}
 	});
 }
+/**
+* A Budget change that leaves `refill` out keeps the Budget's current refill:
+* a change never turns a refill off by omission. An explicit `"none"` turns it
+* off. The backend plans, the SDK verifies and the CLI confirms the same
+* result. A create has no current refill, so a missing one means `none`.
+*/
+function keepRefillOnChange(intent, before) {
+	if (intent.type !== "budget" || intent.refill !== void 0 || before?.type !== "budget" || before.refill !== "monthly") return intent;
+	return {
+		...intent,
+		refill: before.refill
+	};
+}
 //#endregion
 //#region ../../packages/protocol/src/permissions/replacement-schema.ts
 const InvitationPhaseSchema = Schema.Literals([
@@ -5924,7 +6023,7 @@ const InviteGrantsSchema = Schema.Array(Schema.Union([
 	Schema.Struct({
 		type: Schema.Literal("new_budget"),
 		label: Schema.String.pipe(Schema.refine((value) => value.trim().length >= 1 && value.trim().length <= 128)),
-		intent: BudgetIntentSchema
+		intent: BudgetIntentSchema.pipe(Schema.refine((intent) => intent.refill !== "monthly", { message: "An invitation's new Budget cannot refill; change it once granted" }))
 	})
 ])).pipe(Schema.refine((grants) => {
 	if (grants.length < 1 || grants.length > 16) return false;
@@ -9357,7 +9456,9 @@ const PEOPLE_OPERATIONS = {
 			emitSafeConfirmed: "accounts.safes.emitSafeConfirmed",
 			readSafe: "accounts.safes.readSafe",
 			recordDeployment: "accounts.safes.recordDeployment"
-		}
+		},
+		/** The home's requests to pay and Payments to retry, read in one query. */
+		summaries: { loadNeedsYou: "accounts.summaries.loadNeedsYou" }
 	},
 	/** The host observer's names for `client.approvals.*`. */
 	approvals: {
@@ -9616,7 +9717,9 @@ emitSaved: "activity.annotations.emitSaved" },
 		pay: "organizationPayments.pay",
 		payBatch: "organizationPayments.payBatch",
 		prepareExecution: "organizationPayments.prepareExecution",
-		retry: "organizationPayments.retry"
+		retry: "organizationPayments.retry",
+		cancel: "organizationPayments.cancel",
+		redirect: "organizationPayments.redirect"
 	},
 	/**
 	* Payments' internal functions and the client's own method names; its public
@@ -9638,7 +9741,9 @@ emitSaved: "activity.annotations.emitSaved" },
 			loadContext: "payments.commands.loadContext",
 			loadExecutionContext: "payments.commands.loadExecutionContext",
 			/** The capped Budget a prepared Organization command spends from, before its allowance is read on chain. */
-			loadBudgetAllowance: "payments.commands.loadBudgetAllowance"
+			loadBudgetAllowance: "payments.commands.loadBudgetAllowance",
+			/** What a new Payment command would spend and from which Safe, read before it is born. */
+			loadBirthFunding: "payments.commands.loadBirthFunding"
 		},
 		lifecycles: { prepareIntent: "payments.lifecycles.prepareIntent" },
 		/** The stored UserOperation of every money command: Payment, Permission and configuration. */
@@ -9997,6 +10102,13 @@ const OptionalReasonCode = Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES));
 * no catalog schema validates it.
 */
 const EXCEPTION_EVENT_NAME = "$exception";
+/**
+* The SDK's twin of `capxul_backend_expected_outcome`: an expected outcome the
+* SDK's failure projection captures through the host's PostHog client. Like
+* the backend's, its properties are the error evidence, so no catalog schema
+* validates it.
+*/
+const SDK_EXPECTED_OUTCOME_EVENT_NAME = "capxul_sdk_expected_outcome";
 const PII = Schema.String.pipe(Schema.brand("PII"));
 /**
 * The canonical envelope (ADR-0020 A4): snake_case ONLY. `capxul_env` and
@@ -10096,6 +10208,42 @@ const UiStepProps = {
 	organization_id: OptionalOrgId,
 	reason_code: OptionalReasonCode
 };
+/**
+* A journey's variants (`JOURNEYS`): the way a person came into a journey, or
+* the way they took through it. A variant is a property of the journey's step
+* events, never a journey of its own, so each journey funnel breaks down by
+* it. A step event takes only the variants that a journey contract names on
+* it, picked one by one; the analytics plan test checks both directions.
+* `pay_path` and `funding_source` have no carrier until their Phase 2 events.
+* `payment_*` events already carry `recipient_is_capxul_account`, and
+* `invoice_issued` carries `issuer_scope_kind`; neither is repeated here.
+*/
+const JourneyVariantProps = {
+	/** How a person came to Get started: by themselves, an invite, money that waited, or an invoice. */
+	entry_path: Schema.optional(Schema.Literals([
+		"signup",
+		"invite",
+		"claim",
+		"invoice"
+	])),
+	/** Where the person acted. `agent` is an AI agent driving the CLI. */
+	surface: Schema.optional(Schema.Literals([
+		"web",
+		"cli",
+		"agent"
+	])),
+	/** Who pays: a person from their own account, or an Organization from a Budget. */
+	payer_kind: Schema.optional(Schema.Literals(["person", "organization"])),
+	/** How a request was paid: from the payer's inbox, or by its link at checkout. */
+	pay_path: Schema.optional(Schema.Literals(["inbox", "link"])),
+	/** Where an account's first money came from. `bank` is the planned on-ramp. */
+	funding_source: Schema.optional(Schema.Literals([
+		"deposit",
+		"payment",
+		"claim",
+		"bank"
+	]))
+};
 //#endregion
 //#region ../../packages/observability/src/events/money.ts
 /**
@@ -10185,6 +10333,8 @@ const PaymentInitiatedProps = Schema.Struct({
 	execution_id: OptionalString,
 	payment_lifecycle_id: OptionalString,
 	...TelemetryEnvelopeProps,
+	payer_kind: JourneyVariantProps.payer_kind,
+	surface: JourneyVariantProps.surface,
 	...RecipientTelemetryProps,
 	kind: Schema.String,
 	payment_id: Schema.String
@@ -10200,6 +10350,8 @@ const PaymentLifecycleProps = {
 const PaymentSettledL2Props = Schema.Struct({
 	...PaymentLifecycleProps,
 	...TelemetryEnvelopeProps,
+	payer_kind: JourneyVariantProps.payer_kind,
+	surface: JourneyVariantProps.surface,
 	...RecipientTelemetryProps,
 	kind: Schema.String,
 	chain_id: Schema.Finite,
@@ -10407,6 +10559,7 @@ const OrganizationCreationStartedProps = Schema.Struct({
 });
 const OrganizationCreationReadyProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String,
 	organization_id: OrgIdTelemetrySchema,
 	attempt_number: AttemptNumberSchema,
@@ -10431,45 +10584,6 @@ const OrganizationCreationFailedProps = Schema.Struct({
 		...ORGANIZATION_SETUP_REASONS
 	]))
 });
-const OrgCreateStartedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	email_domain: OptionalString,
-	template: OptionalString
-});
-const OrgSafeCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress
-});
-const OrgSafeConfirmedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgRolesSeededProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	role: OptionalString,
-	txHash: OptionalTxHash
-});
-const OrgCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgCreateFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	...ChainCauseTelemetryProps,
-	org_id: OptionalOrgId,
-	reason: OptionalString
-});
 const OrgInviteSentProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
@@ -10514,30 +10628,6 @@ const OrganizationCreationFailedTelemetryEventSchema = Schema.Struct({
 	name: Schema.Literal("organization_creation_failed"),
 	props: OrganizationCreationFailedProps
 });
-const OrgCreateStartedTelemetryEventSchema = Schema.Struct({
-	name: Schema.Literal("org_create_started"),
-	props: OrgCreateStartedProps
-});
-const OrgSafeCreatedTelemetryEventSchema = Schema.Struct({
-	name: Schema.Literal("org_safe_created"),
-	props: OrgSafeCreatedProps
-});
-const OrgSafeConfirmedTelemetryEventSchema = Schema.Struct({
-	name: Schema.Literal("org_safe_confirmed"),
-	props: OrgSafeConfirmedProps
-});
-const OrgRolesSeededTelemetryEventSchema = Schema.Struct({
-	name: Schema.Literal("org_roles_seeded"),
-	props: OrgRolesSeededProps
-});
-const OrgCreatedTelemetryEventSchema = Schema.Struct({
-	name: Schema.Literal("org_created"),
-	props: OrgCreatedProps
-});
-const OrgCreateFailedTelemetryEventSchema = Schema.Struct({
-	name: Schema.Literal("org_create_failed"),
-	props: OrgCreateFailedProps
-});
 const OrgInviteSentTelemetryEventSchema = Schema.Struct({
 	name: Schema.Literal("org_invite_sent"),
 	props: OrgInviteSentProps
@@ -11436,10 +11526,14 @@ const BootstrapFailedProps = Schema.Struct({
 });
 const MemberActivationStartedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	entry_path: JourneyVariantProps.entry_path,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String
 });
 const MemberActivationReadyProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	entry_path: JourneyVariantProps.entry_path,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String,
 	duration_ms: DurationMsSchema
 });
@@ -11564,12 +11658,6 @@ const TELEMETRY_EVENT_SCHEMAS = {
 	bundler_error: BundlerErrorTelemetryEventSchema,
 	receipt_pending: ReceiptPendingTelemetryEventSchema,
 	operation_retried: OperationRetriedTelemetryEventSchema,
-	org_create_started: OrgCreateStartedTelemetryEventSchema,
-	org_safe_created: OrgSafeCreatedTelemetryEventSchema,
-	org_safe_confirmed: OrgSafeConfirmedTelemetryEventSchema,
-	org_roles_seeded: OrgRolesSeededTelemetryEventSchema,
-	org_created: OrgCreatedTelemetryEventSchema,
-	org_create_failed: OrgCreateFailedTelemetryEventSchema,
 	org_invite_sent: OrgInviteSentTelemetryEventSchema,
 	org_invite_accepted: OrgInviteAcceptedTelemetryEventSchema,
 	org_invite_expired: OrgInviteExpiredTelemetryEventSchema,
@@ -11929,56 +12017,6 @@ function stripUrlQueryAndFragment(value) {
 	return value.slice(0, Math.min(queryIndex, fragmentIndex));
 }
 //#endregion
-//#region src/runtime/command-metadata.ts
-var CliCommandMetadata = class extends Context.Service()("capxul-cli/CommandMetadata") {};
-const collectionControl = (name) => name === "config" || name === "config.telemetry" || name.startsWith("config.telemetry.");
-/** Resolve only a complete path supplied by the native parser. */
-function commandAtPath(root, path) {
-	if (path[0] !== root.name) return void 0;
-	let selected = root;
-	for (const part of path.slice(1)) {
-		const child = selected.subcommands.flatMap((group) => group.commands).find((candidate) => candidate.name === part || candidate.alias === part);
-		if (child === void 0) return void 0;
-		selected = child;
-	}
-	return selected;
-}
-const validateNativeScope = (input) => {
-	if (typeof input === "object" && input !== null && "orgs" in input && Array.isArray(input.orgs) && input.orgs.every((id) => typeof id === "string") && new Set(input.orgs).size > 1) return Effect.fail(new CliError.InvalidValue({
-		option: "org",
-		value: "multiple IDs",
-		expected: "one exact Organization ID",
-		kind: "flag"
-	}));
-	return Effect.void;
-};
-/** Keep the native grammar and validate scope without business actions. */
-function nativeInputTree(node) {
-	const input = Command.withHandler(node, validateNativeScope);
-	const children = node.subcommands.flatMap((group) => {
-		const commands = group.commands.map(nativeInputTree);
-		return group.group === void 0 ? commands : [{
-			group: group.group,
-			commands
-		}];
-	});
-	return Command.withSubcommands(input, children);
-}
-function metadataAtPath(root, path) {
-	let selected = root;
-	for (const part of path.slice(1)) {
-		const child = selected.subcommands.flatMap((group) => group.commands).find((command) => command.name === part || command.alias === part);
-		if (child === void 0) break;
-		selected = child;
-	}
-	const metadata = Context.getOption(selected.annotations, CliCommandMetadata);
-	return Option.isSome(metadata) && CLI_COMMAND_NAMES.includes(metadata.value.name) ? metadata.value : {
-		name: "unknown",
-		capability: "cli",
-		observation: "command"
-	};
-}
-//#endregion
 //#region ../../packages/sdk/src/access/actor-references.ts
 function actorReferenceToBackend(actor) {
 	if (actor === void 0) return void 0;
@@ -12222,7 +12260,7 @@ const FIELD_RULES = {
 	},
 	anonymousId: {
 		maxLength: 128,
-		pattern: /^anon_[A-Za-z0-9-]+$/u
+		pattern: /^(?:anon_[A-Za-z0-9-]+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/u
 	},
 	traceparent: {
 		maxLength: 55,
@@ -14870,7 +14908,7 @@ function mapAccountLifecycle(input) {
 }
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$2 = "4.20.0-beta.27";
+var version$2 = "4.20.0-beta.28";
 //#endregion
 //#region ../../packages/sdk/src/observability/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -15308,7 +15346,7 @@ const REVERT_SELECTOR_RE = /^0x(?:[0-9a-fA-F]{8})?$/u;
 //#region ../../packages/sdk/src/observability/posthog-failure.ts
 /** The expected-outcome codes, read as plain strings so a free-form kind can be looked up. */
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
-const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
+const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = SDK_EXPECTED_OUTCOME_EVENT_NAME;
 /**
 * Adapt the host's already-initialized PostHog-like client. This function does
 * not import, initialize, configure, or own PostHog.
@@ -18160,6 +18198,12 @@ function paymentsV2Signature(name) {
 const SEND_SIGNATURE = paymentsV2Signature("send");
 const SEND_BATCH_SIGNATURE = paymentsV2Signature("sendBatch");
 const CREATE_COMMITMENT_SIGNATURE = paymentsV2Signature("createCommitment");
+/**
+* #2299 ruling C: only an Owner cancels or redirects an Organization-funded
+* commitment, so these two sit in the Owner role's scope, never a Budget's.
+* The contract admits only the commitment's creator, the Organization Safe.
+*/
+const OWNER_COMMITMENT_SIGNATURES = [paymentsV2Signature("cancel"), paymentsV2Signature("redirect")];
 //#endregion
 //#region ../../packages/protocol/src/evm/organization-payments.ts
 /** Zodiac ModuleProxyFactory on Base Sepolia. */
@@ -18396,24 +18440,18 @@ function encodePreparedPaymentCallData(command) {
 		}));
 	}
 	const [item] = command.items;
-	if (command.executionRoute.kind !== "direct" || command.items.length !== 1 || item === void 0 || isBirth(item)) throw Errors.invalidInput("items", "Commitment lifecycle requires one direct execution");
-	return safe4337ExecuteUserOpCallData({
+	const route = command.executionRoute;
+	if (command.items.length !== 1 || item === void 0 || isBirth(item) || route.kind !== "direct" && item.operation === "claim_commitment") throw Errors.invalidInput("items", "Commitment lifecycle requires one lone execution");
+	const call = {
 		to: command.contractAddress,
+		value: 0n,
 		data: lifecycleData(item)
-	});
-}
-//#endregion
-//#region ../../packages/protocol/src/evm/role-dsl.ts
-const ORG_BUDGET_ACTIONS = [
-	"send",
-	"sendBatch",
-	"createCommitment"
-];
-/** Derive the Zodiac substrate key for one durable Permission identity. */
-function roleKeyForPermission(permissionId) {
-	const normalized = permissionId.trim();
-	if (normalized.length === 0 || normalized !== permissionId) throw Errors.invalidInput("permissionId", "must be a non-empty canonical Permission ID");
-	return keccak256$1(toBytes$1(`permission ${permissionId}`));
+	};
+	return route.kind === "direct" ? safe4337ExecuteUserOpCallData(call) : buildOrgRoleSpendPersonalCallData(buildOrgRoleMultiCall({
+		rolesModuleAddress: route.rolesModule,
+		roleKey: route.roleKey,
+		calls: [call]
+	}));
 }
 //#endregion
 //#region ../../packages/sdk/src/payments/operation-verification.ts
@@ -18442,6 +18480,16 @@ function moneySafeOpDigest(operation, chainId) {
 		userOp: safe4337UserOperation(operation)
 	});
 }
+/**
+* An Organization-funded cancel or redirect runs through the Owner role
+* (#2299), which no Budget names. Its role key cannot widen what the signer
+* may do: the Roles module admits only a role the signer's Safe holds, and the
+* contract admits only the commitment's creator.
+*/
+function isOwnerLifecycle(command) {
+	const [item] = command.items;
+	return command.items.length === 1 && (item?.operation === "cancel_commitment" || item?.operation === "redirect_commitment");
+}
 /** Verify every actual Money signing target against configured trust anchors. */
 function verifiesMoneyOperation(evidence, expectedSafe, chainId, permissionId) {
 	try {
@@ -18452,7 +18500,7 @@ function verifiesMoneyOperation(evidence, expectedSafe, chainId, permissionId) {
 		const route = command.executionRoute;
 		if (route.kind === "direct") {
 			if (permissionId !== void 0 || command.senderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return false;
-		} else if (permissionId === void 0 || route.roleKey.toLowerCase() !== roleKeyForPermission(permissionId).toLowerCase() || command.senderSafe.toLowerCase() !== route.organizationSafe.toLowerCase()) return false;
+		} else if ((permissionId === void 0 ? !isOwnerLifecycle(command) : route.roleKey.toLowerCase() !== roleKeyForPermission(permissionId).toLowerCase()) || command.senderSafe.toLowerCase() !== route.organizationSafe.toLowerCase()) return false;
 		if (operation.callData.toLowerCase() !== encodePreparedPaymentCallData(command).toLowerCase()) return false;
 		const digest = moneySafeOpDigest(operation, chainId);
 		return evidence.digest.toLowerCase() === digest.toLowerCase() && evidence.executionId === `money_execution_${digest.slice(2).toLowerCase()}`;
@@ -19231,9 +19279,11 @@ function subscribeFreshQuery(deps, args, listener, operation, projection, option
 //#region ../../packages/sdk/src/payments/lifecycle-execution.ts
 /**
 * The prepared command is this lifecycle intent; a retry also names the
-* original birth command of the scope it was asked for.
+* original birth command of the scope it was asked for. A claim, and an
+* Account's own cancel or redirect, runs directly from the signer's Safe; an
+* Organization's cancel or redirect runs through its Owner role (#2299).
 */
-const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind !== "retry" || (expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId));
+const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind === "retry" ? expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId : evidence.preparedCommand?.executionRoute.kind === (intent.kind === "claim" || expectedOrganizationId === void 0 ? "direct" : "zodiac_role"));
 /** The prepared command pays exactly the request the payer confirmed. */
 const requestPaymentCheck = (confirmation) => async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation);
 function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganizationId, onPrepared) {
@@ -20123,17 +20173,21 @@ function paymentExecutionIntent(input) {
 	const to = normalizeTargetForBackend(input.to, "to");
 	if (!to.ok) return to;
 	try {
-		return {
+		const decoded = Schema.decodeResult(PaymentExecutionIntentSchema, { onExcessProperty: "error" })({
+			to: to.value,
+			amount: input.amount,
+			...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
+			...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
+			...input.document === void 0 ? {} : { document: input.document },
+			...input.supportingReceipts === void 0 ? {} : { supportingReceipts: input.supportingReceipts },
+			...input.timing === void 0 ? {} : { timing: input.timing }
+		});
+		return Result.isSuccess(decoded) ? {
 			ok: true,
-			value: Schema.decodeSync(PaymentExecutionIntentSchema, { onExcessProperty: "error" })({
-				to: to.value,
-				amount: input.amount,
-				...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
-				...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
-				...input.document === void 0 ? {} : { document: input.document },
-				...input.supportingReceipts === void 0 ? {} : { supportingReceipts: input.supportingReceipts },
-				...input.timing === void 0 ? {} : { timing: input.timing }
-			})
+			value: decoded.success
+		} : {
+			ok: false,
+			error: invalidPaymentField(decoded.failure.issue)
 		};
 	} catch {
 		return {
@@ -20142,6 +20196,13 @@ function paymentExecutionIntent(input) {
 		};
 	}
 }
+const formatIssue = SchemaIssue.makeFormatterStandardSchemaV1();
+/** The first failing field and why, e.g. `amount.value`, as the backend's row decode names it (#2381). */
+function invalidPaymentField(issue) {
+	const first = formatIssue(issue).issues[0];
+	const field = first?.path?.map((segment) => String(typeof segment === "object" ? segment.key : segment)).join(".");
+	return Errors.invalidInput(field === void 0 || field.length === 0 ? "payment" : field, first?.message ?? "invalid personal payment input");
+}
 function normalizePaymentTiming(payment) {
 	const { release: _release, ...rest } = payment;
 	return {
@@ -20958,6 +21019,27 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 		flights: /* @__PURE__ */ new Map()
 	};
 	const execute = (input, signal, operation = "organization-pay-batch", controls, onPrepared) => executeOrganizationBatch(scope, input, signal, operation, controls, onPrepared);
+	/** One Owner-signed cancel or redirect, answering the one Payment it acted on (#2299). */
+	const ownerLifecycle = (intent, controls, operation) => runCapxulEffect(Effect.gen(function* () {
+		const captured = carryInvocationParentSpan(controls, yield* Effect.currentSpan.pipe(Effect.orDie));
+		return yield* awaitCapxulResult(async () => {
+			const execution = executionDependencies$1(deps);
+			if (execution === null) return {
+				ok: false,
+				error: Errors.notImplemented("organizationPayments", "executionComposition")
+			};
+			const result = await executePaymentLifecycle(execution, intent, controls?.signal, captured, orgId);
+			if (!result.ok) return result;
+			const [payment, ...rest] = result.value.payments;
+			return payment === void 0 || rest.length !== 0 ? {
+				ok: false,
+				error: Errors.unknown()
+			} : {
+				ok: true,
+				value: normalizePaymentTiming(payment)
+			};
+		});
+	}), observationOnlyControls(controls), operation, deps.runPromise);
 	return {
 		...makeOrganizationPaymentReadMethods(deps, orgId),
 		retry: (paymentId, options) => {
@@ -21016,6 +21098,19 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 				});
 			}), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.pay, deps.runPromise);
 		},
+		cancel: (paymentId, options) => ownerLifecycle({
+			kind: "cancel",
+			paymentId
+		}, deps.invocationControls?.(options) ?? options, CAPXUL_OPERATIONS.organizationPayments.cancel),
+		redirect: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			const recipient = normalizeTargetForBackend(input.to, "to");
+			return recipient.ok ? ownerLifecycle({
+				kind: "redirect",
+				paymentId: input.paymentId,
+				recipient: recipient.value
+			}, controls, CAPXUL_OPERATIONS.organizationPayments.redirect) : runCapxulEffect(Effect.fail(recipient.error), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.redirect, deps.runPromise);
+		},
 		payBatch: (input, options) => {
 			const controls = deps.invocationControls?.(options) ?? options;
 			return runCapxulEffect(Effect.gen(function* () {
@@ -25305,6 +25400,40 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	return ignoreTransportFailure(() => invocationTelemetry.emit(mapped), "emit", mapped.name).pipe(Effect.andThen(ignoreTransportFailure(after, mapped.name === "auth_signed_out" ? "reset" : "identify", mapped.name)));
 }
 //#endregion
+//#region ../../packages/sdk/src/money/format.ts
+function formatMoney(money, options = {}) {
+	if (!Number.isInteger(money.decimals) || money.decimals < 0) throw Errors.invalidInput("money.decimals", "must be a non-negative integer");
+	const symbol = currencySymbolFor(toCurrencyCode(money.currency));
+	const maximumFractionDigits = options.grammar === "code" ? 4 : 2;
+	const rounded = roundDecimal(money.value, money.decimals, maximumFractionDigits);
+	const grouped = rounded.integer.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+	const signed = `${rounded.negative ? "-" : ""}${grouped}`;
+	if (options.grammar === "code") {
+		if (!rounded.hadFraction) return `${signed} ${money.currency}`;
+		let displayedFraction = rounded.fraction;
+		while (displayedFraction.length > 2 && displayedFraction.endsWith("0")) displayedFraction = displayedFraction.slice(0, -1);
+		return `${signed}.${displayedFraction} ${money.currency}`;
+	}
+	return `${symbol}${signed}.${rounded.fraction}`;
+}
+function roundDecimal(value, decimals, maximumFractionDigits) {
+	const match = /^(-?)(\d+)(?:\.(\d+))?$/.exec(value);
+	if (match === null) throw Errors.invalidInput("money.value", "must be a base-10 decimal string");
+	const integer = match[2] ?? "0";
+	const sourceFraction = match[3] ?? "";
+	if (sourceFraction.length > decimals) throw Errors.invalidInput("money.value", "fraction exceeds money.decimals");
+	const scale = 10n ** BigInt(maximumFractionDigits);
+	const keptFraction = sourceFraction.slice(0, maximumFractionDigits).padEnd(maximumFractionDigits, "0");
+	let scaled = BigInt(integer) * scale + BigInt(keptFraction || "0");
+	if ((sourceFraction[maximumFractionDigits] ?? "0") >= "5") scaled += 1n;
+	return {
+		negative: match[1] === "-",
+		integer: (scaled / scale).toString(),
+		fraction: (scaled % scale).toString().padStart(maximumFractionDigits, "0"),
+		hadFraction: /[1-9]/.test(sourceFraction)
+	};
+}
+//#endregion
 //#region ../../packages/sdk/src/permissions/command-decoding.ts
 /** The caller's input as a command: ids branded and the intent decoded, or invalid input thrown. */
 const buildCommand = {
@@ -34966,13 +35095,15 @@ function normalizeOrgBudgetPolicy(policy) {
 		if (actionSet.has(action)) throw Errors.invalidInput("policy.actions", `duplicate Budget action: ${action}`);
 		actionSet.add(action);
 	}
+	if (policy.refill === "monthly" && limit.kind === "unlimited") throw Errors.invalidInput("policy.refill", "only a capped Budget can refill");
 	return {
 		assetId,
 		tokenAddress,
 		decimals: policy.asset.decimals,
 		limit,
 		recipients,
-		actions: ORG_BUDGET_ACTIONS.filter((action) => actionSet.has(action))
+		actions: ORG_BUDGET_ACTIONS.filter((action) => actionSet.has(action)),
+		refillPeriod: policy.refill === "monthly" ? MONTHLY_REFILL_PERIOD_SECONDS : 0n
 	};
 }
 function resolvedBudgetApprovalPermission(tokenAddress) {
@@ -35047,8 +35178,8 @@ function buildOrgBudgetCallsWithEncoder(input, encodeRoles) {
 				allowanceKey,
 				BigInt(policy.limit.rawUnits),
 				BigInt(policy.limit.rawUnits),
-				0n,
-				0n,
+				policy.refillPeriod === 0n ? 0n : BigInt(policy.limit.rawUnits),
+				policy.refillPeriod,
 				0n
 			]
 		}),
@@ -35242,13 +35373,20 @@ function buildExplicitBootstrapRoleCalls(input, encodeRoles) {
 		roles: [{
 			key: managementRoleKey,
 			members: [input.ownerAddress],
-			permissions: [{
-				targetAddress: input.rolesModuleAddress,
-				signature: "assignRoles(address,bytes32[],bool[])"
-			}, ...ROLE_MANAGEMENT_SIGNATURES.map((signature) => ({
-				targetAddress: input.rolesModuleAddress,
-				signature
-			}))]
+			permissions: [
+				{
+					targetAddress: input.rolesModuleAddress,
+					signature: "assignRoles(address,bytes32[],bool[])"
+				},
+				...ROLE_MANAGEMENT_SIGNATURES.map((signature) => ({
+					targetAddress: input.rolesModuleAddress,
+					signature
+				})),
+				...OWNER_COMMITMENT_SIGNATURES.map((signature) => ({
+					targetAddress: CAPXUL_PAYMENTS_V2_ADDRESS,
+					signature
+				}))
+			]
 		}]
 	}).map((call) => ({
 		to: toLowerHex(call.to, "setUpRoles.call.to"),
@@ -35716,7 +35854,7 @@ function matchesCurrentPolicy(intent, policy) {
 		asset: policy.asset,
 		value: policy.limit
 	}, CONFIGURED_MONEY_ASSETS).minorUnits;
-	return policy.asset === intent.asset && raw === recorded && (intent.scope === void 0 || canonicalJson(intent.scope) === canonicalJson(policy.scope));
+	return policy.asset === intent.asset && raw === recorded && intent.refill === "monthly" === (policy.refill === "monthly") && (intent.scope === void 0 || canonicalJson(intent.scope) === canonicalJson(policy.scope));
 }
 function previousPolicyForChange(effect, command) {
 	if (effect.previousIntent.type === "budget" && (effect.previousIntent.scope === void 0 || effect.previousRecipientBindings === void 0)) throw new EvidenceMismatch("Prior complete Budget proof is unavailable");
@@ -35734,8 +35872,9 @@ function policyCalls(evidence, context, command) {
 	const roleKey = effect.operation === "change" ? effect.roleKey : roleKeyForPermission(permissionId);
 	const revision = effect.operation === "change" ? effect.revision : 0;
 	if (effect.operation !== command.operation || effect.operation === "change" && effect.permissionId !== permissionId || evidence.expectedRevision !== revision) throw new EvidenceMismatch("Permission policy binding mismatch");
+	const intent = effect.operation === "change" ? keepRefillOnChange(command.intent, effect.previousCurrentPolicy) : command.intent;
 	const value = evidence.value;
-	if (Array.isArray(value) || !("type" in value) || !matchesCurrentPolicy(command.intent, value.currentPolicy) || !permissionMatches(value, context.orgId, permissionId, command.operation === "create" ? 0 : revision + 1, command.intent, roleKey)) throw new EvidenceMismatch("Permission value mismatch");
+	if (Array.isArray(value) || !("type" in value) || !matchesCurrentPolicy(intent, value.currentPolicy) || !permissionMatches(value, context.orgId, permissionId, command.operation === "create" ? 0 : revision + 1, intent, roleKey)) throw new EvidenceMismatch("Permission value mismatch");
 	const planned = compilePermissionPolicyCallsWithEncoder({
 		permissionId,
 		roleKey,
@@ -35743,7 +35882,7 @@ function policyCalls(evidence, context, command) {
 		actorSafe: evidence.userOpSenderSafe,
 		rolesModule: context.rolesModule,
 		managerRoleKey: context.managerRoleKey,
-		nextIntent: encodingIntent(command.intent, effect.recipientBindings),
+		nextIntent: encodingIntent(intent, effect.recipientBindings),
 		...previous === void 0 ? {} : { previousIntent: previous },
 		...effect.operation !== "change" || effect.previousAllowanceKey === null ? {} : { previousAllowanceKey: effect.previousAllowanceKey }
 	}, encodeRoles);
@@ -35795,7 +35934,8 @@ function encodingIntent(intent, bindings) {
 				"send",
 				"sendBatch",
 				"createCommitment"
-			].filter((action) => action === "createCommitment" ? intent.scope.actions.includes("commitments") : intent.scope.actions.includes("pay"))
+			].filter((action) => action === "createCommitment" ? intent.scope.actions.includes("commitments") : intent.scope.actions.includes("pay")),
+			...intent.refill === "monthly" ? { refill: intent.refill } : {}
 		}
 	};
 }
@@ -60190,6 +60330,22 @@ function normalizeRuntimeUrl(field, raw) {
 }
 //#endregion
 //#region ../../packages/sdk/src/applications/bootstrap-adapter.ts
+/** A cached envelope this close to its expiry is fetched again, so it cannot lapse mid-command. */
+const CACHE_EXPIRY_MARGIN_MS = 3e4;
+/**
+* The cached envelope, when it is still inside its own lifetime. It is decoded
+* as a fresh body is; anything that does not decode, or a store that fails,
+* is a miss.
+*/
+async function cachedEnvelope(cache, now) {
+	try {
+		const cached = decodeBootstrapBody(await cache.load());
+		const expiresAt = cached.issuedAt + cached.expiresIn - CACHE_EXPIRY_MARGIN_MS;
+		return cached.issuedAt <= now && now < expiresAt ? cached : null;
+	} catch {
+		return null;
+	}
+}
 const DEFAULT_RETRY = {
 	attempts: 2,
 	baseDelayMs: 400
@@ -60230,19 +60386,24 @@ var HttpBootstrapAdapter = class {
 	fetchImpl;
 	observation;
 	retry;
+	cache;
 	constructor(deps) {
 		this.bootstrapBaseUrl = deps.bootstrapBaseUrl.replace(/\/$/, "");
 		this.bootstrapHost = hostOf(this.bootstrapBaseUrl);
 		this.observation = deps.observation;
 		this.retry = deps.retry ?? DEFAULT_RETRY;
+		this.cache = deps.cache;
 		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	}
 	resolve(input) {
-		return this.attempt(input).pipe(Effect.retry({
+		const fetched = this.attempt(input).pipe(Effect.retry({
 			times: this.retry.attempts,
 			while: isTransientBootstrapFailure,
 			schedule: Schedule.exponential(Duration.millis(this.retry.baseDelayMs))
 		}));
+		const cache = this.cache;
+		if (cache === void 0) return fetched;
+		return Effect.promise(() => cachedEnvelope(cache, Date.now())).pipe(Effect.filterOrElse((cached) => cached !== null, () => fetched));
 	}
 	attempt(input) {
 		return Effect.tryPromise({
@@ -60267,7 +60428,13 @@ var HttpBootstrapAdapter = class {
 	}
 	mapResponse(res, input) {
 		if (res.ok) return Effect.tryPromise({
-			try: async () => decodeBootstrapBody(await res.json()),
+			try: async () => {
+				const body = await res.json();
+				const resolution = decodeBootstrapBody(body);
+				const cache = this.cache;
+				if (cache !== void 0) await Promise.resolve().then(() => cache.save(body)).catch(() => void 0);
+				return resolution;
+			},
 			catch: (cause) => {
 				if (cause instanceof CapxulError && cause.code === "INVALID_INPUT") return bootstrapErrorFromCapxul("invalidInput", cause);
 				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
@@ -61934,7 +62101,9 @@ function makeNotImplementedOrganizationPaymentsMethods() {
 		subscribe: organizationPaymentExecutionUnavailable,
 		pay: organizationPaymentExecutionUnavailable,
 		payBatch: organizationPaymentExecutionUnavailable,
-		retry: organizationPaymentExecutionUnavailable
+		retry: organizationPaymentExecutionUnavailable,
+		cancel: organizationPaymentExecutionUnavailable,
+		redirect: organizationPaymentExecutionUnavailable
 	};
 }
 const orgMeUnavailable = () => Promise.resolve({
@@ -66127,6 +66296,23 @@ function subscribeConvexQuery(client, fn, args, callback, options) {
 * ever needs a different one.
 */
 const DEFAULT_CLOSE_TIMEOUT_MS = 5e3;
+/**
+* The fetcher the Convex client's auth handshake gets. Convex first asks for
+* "a possibly cached token" (`forceRefreshToken: false`) and, as soon as the
+* server accepts it, for a fresh one (`true`): the token whose `exp` it
+* schedules the next refresh from. The Better Auth clients keep no token: each
+* ask mints one over the network, so the cached ask was a second token fetch
+* and a second server verification (a JWKS read) on every session restore. It
+* answers "none" instead, and Convex makes its one fetch forced, as a fresh
+* token. Every forced ask still reaches the auth client: that first fetch, the
+* refresh before `exp`, and the retry after the server rejects a token.
+* ponytail: the OAuth bearer client can hold a cached exchange; it now pays one
+* exchange for the first authentication instead of reusing it (never more
+* fetches than before). Pass the cache through if that start ever matters.
+*/
+function freshTokenHandshake(fetchToken) {
+	return async (args) => args.forceRefreshToken ? fetchToken(args) : null;
+}
 /** Run a Convex call under the current trace parent, when there is one. */
 const withTraceparent = (run) => Effect.flatMap(Effect.serviceOption(Tracer.ParentSpan), (parent) => run(parent._tag === "Some" ? formatTraceparent(parent.value) : void 0));
 var ConvexCallAdapter = class {
@@ -66151,10 +66337,10 @@ var ConvexCallAdapter = class {
 		this.#tokenProvider = deps.tokenProvider;
 		this.#applicationId = deps.applicationId;
 		this.#observation = deps.observation;
-		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
+		this.refreshAuth();
 	}
 	refreshAuth() {
-		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
+		if (this.#tokenProvider) this.#client.setAuth(freshTokenHandshake(this.#tokenProvider));
 	}
 	observeConnection(observer) {
 		return this.#connectionMonitor.observe(this.#client, observer);
@@ -67821,7 +68007,8 @@ async function createProductionAdapters(input) {
 	const bootstrapLayer = HttpBootstrapLayer({
 		bootstrapBaseUrl: resolvedInput.value.bootstrapBaseUrl,
 		...input.fetch === void 0 ? {} : { fetch: input.fetch },
-		...invocationObservation === void 0 ? {} : { observation: invocationObservation }
+		...invocationObservation === void 0 ? {} : { observation: invocationObservation },
+		...input.bootstrapCache === void 0 ? {} : { cache: input.bootstrapCache }
 	});
 	try {
 		const bootstrapContext = await Effect.runPromise(Layer.buildWithScope(bootstrapLayer, scope));
@@ -68877,253 +69064,6 @@ function checkoutUrl(frontendOrigin, reference) {
 	return result.href;
 }
 //#endregion
-//#region src/observability/projection.ts
-const codes = [
-	...CAPXUL_ERROR_CODES,
-	"CLI_USAGE",
-	"CLI_CONFIG",
-	"CLI_STORAGE",
-	"CLI_DEFECT",
-	"CLI_DEADLINE"
-];
-/** A known Capxul or CLI error code, never a free-form string from a source. */
-const safeCode = (value) => codes.find((code) => code === value);
-/** Read one own data property without running a getter on a hostile value. */
-const own = (value, key) => {
-	if (typeof value !== "object" || value === null) return void 0;
-	try {
-		return Object.getOwnPropertyDescriptor(value, key)?.value;
-	} catch {
-		return;
-	}
-};
-/** The numeric and enumerated SDK failure facts a diagnostic log may keep. */
-function projectSdkProperties(properties) {
-	const output = {};
-	for (const key of [
-		"chainId",
-		"chain_id",
-		"durationMs",
-		"duration_ms",
-		"http_status",
-		"retry_count"
-	]) {
-		const value = own(properties, key);
-		if (typeof value === "number" && Number.isFinite(value) && value >= 0) output[key] = value;
-	}
-	for (const key of [
-		"error_kind",
-		"error_code",
-		"reason_code"
-	]) {
-		const value = safeCode(own(properties, key));
-		if (value !== void 0) output[key] = value;
-	}
-	const operation = own(properties, "operation");
-	if (isCapxulOperation(operation)) output.operation = operation;
-	const failureMode = FAILURE_MODES$1.find((mode) => mode === own(properties, "failure_mode"));
-	if (failureMode !== void 0) output.failure_mode = failureMode;
-	return output;
-}
-/** A source-only `$exception`: basenames, function names and lines, never messages or paths. */
-function projectException(properties, command, kind = "CLI_DEFECT") {
-	const sanitized = sanitizePostHogBrowserEvent({
-		event: "$exception",
-		properties: { ...properties }
-	}).properties;
-	const exceptions = own(sanitized, "$exception_list");
-	const stacktrace = own(Array.isArray(exceptions) ? exceptions[0] : void 0, "stacktrace");
-	const rawFrames = own(stacktrace, "frames");
-	const frames = (Array.isArray(rawFrames) ? rawFrames : []).slice(0, 12).map((frame) => {
-		const filename = own(frame, "filename");
-		const basename = typeof filename === "string" ? filename.split(/[\\/]/u).at(-1)?.split(/[?#]/u)[0] : void 0;
-		const name = own(frame, "function");
-		return {
-			platform: "node:javascript",
-			filename: `capxul-cli:///${basename !== void 0 && /^[A-Za-z0-9._-]{1,96}$/u.test(basename) ? basename : "boundary"}`,
-			function: typeof name === "string" && /^[A-Za-z_$<>][A-Za-z0-9_$.<>-]{0,95}$/u.test(name) ? name : "<anonymous>",
-			lineno: boundedLine(own(frame, "lineno")),
-			colno: boundedLine(own(frame, "colno"))
-		};
-	});
-	return {
-		$exception_type: kind,
-		$exception_message: kind === "CLI_DEFECT" ? "CLI command failed" : "SDK operation failed",
-		$exception_level: "error",
-		$exception_fingerprint: `cli.${command}.${kind}:${frames[0]?.filename ?? "boundary"}:${frames[0]?.function ?? "unknown"}`,
-		$issue_name: `${kind === "CLI_DEFECT" ? "CLI" : "SDK"} ${command} defect`,
-		$exception_list: [{
-			type: kind,
-			value: kind === "CLI_DEFECT" ? "CLI command failed" : "SDK operation failed",
-			mechanism: {
-				handled: true,
-				type: kind === "CLI_DEFECT" ? "capxul_cli_boundary" : "capxul_cli_sdk_boundary"
-			},
-			stacktrace: {
-				type: "raw",
-				frames
-			}
-		}]
-	};
-}
-const boundedLine = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= 1e7 ? value : null;
-//#endregion
-//#region src/observability/capture.ts
-const isTelemetryEventName = (event) => Object.hasOwn(TELEMETRY_EVENT_SCHEMAS, event);
-const CAPTURE_BYTES = 8192;
-const textEncoder = new TextEncoder();
-const IDENTITY_KEYS = /* @__PURE__ */ new Set([
-	"actor_id",
-	"actor_kind",
-	"auth_user_id",
-	"anonymous_id",
-	"cli_identity_kind",
-	"distinct_id",
-	"$groups"
-]);
-/** The bounded PostHog capture queue writers for one invocation. Nothing here sends. */
-const makeCaptures = (options) => {
-	const { input, token, envelope, enabled, clock, queue, state } = options;
-	const enqueue = (body) => {
-		if (textEncoder.encode(body).byteLength > CAPTURE_BYTES || !Queue.offerUnsafe(queue, body)) state.dropped += 1;
-	};
-	const capture = (event, properties, identity) => {
-		if (!enabled()) {
-			state.dropped += 1;
-			return;
-		}
-		const occurredAt = identity?.observedAt ?? clock.currentTimeMillisUnsafe();
-		const record = sanitizePostHogBrowserEvent({
-			event,
-			properties: {
-				...properties,
-				...envelope,
-				occurred_at: occurredAt,
-				...state.nativeContext
-			}
-		});
-		if (event === "access_recovery_completed") {
-			const checked = Schema.decodeUnknownOption(TELEMETRY_EVENT_SCHEMAS.access_recovery_completed)({
-				name: event,
-				props: properties
-			});
-			if (Option.isSome(checked) && checked.value.name === "access_recovery_completed") record.properties.recovery = checked.value.props.recovery;
-		}
-		enqueue(JSON.stringify({
-			api_key: token,
-			...record,
-			uuid: identity?.eventId ?? crypto.randomUUID(),
-			timestamp: new Date(occurredAt).toISOString(),
-			properties: {
-				...record.properties,
-				distinct_id: input.anonymousIdentity?.id ?? input.invocationId,
-				$process_person_profile: false
-			}
-		}));
-	};
-	/**
-	* Join this epoch's anonymous history to the person AUTH verified.
-	*
-	* This is a PostHog lifecycle event, not a catalog event: it carries the
-	* person as `distinct_id` and the epoch as `$anon_distinct_id`, and
-	* deliberately omits `$process_person_profile` so the merge is processed —
-	* every catalog event here sets it false, which is what keeps those events off
-	* the person until this record exists.
-	*
-	* The binding's own stored `eventId` is the record UUID, so PostHog
-	* deduplicates a replayed merge. The same idiom `cli_first_used` uses.
-	*
-	* No `$set` traits: identify traits bypass the per-event redactor, and this
-	* module has no pre-minimized person fact to send. The merge is the whole
-	* payload.
-	*/
-	const captureIdentify = (authUserId, anonymousId, eventId, occurredAt) => {
-		if (!enabled()) {
-			state.dropped += 1;
-			return;
-		}
-		enqueue(JSON.stringify({
-			api_key: token,
-			event: "$identify",
-			uuid: eventId,
-			timestamp: new Date(occurredAt).toISOString(),
-			properties: {
-				capxul_env: input.environment,
-				distinct_id: authUserId,
-				$anon_distinct_id: anonymousId
-			}
-		}));
-	};
-	const captureSdkDiagnostic = (event, properties) => {
-		const code = safeCode(own(properties, "error_kind")) ?? (event === "$exception" ? "UNKNOWN" : void 0);
-		const operation = own(properties, "operation");
-		if (code === void 0 || state.sdkDiagnostics.length >= 32) {
-			state.dropped += 1;
-			return;
-		}
-		state.sdkDiagnostics.push({
-			log: {
-				...projectSdkProperties(properties),
-				error_code: code,
-				...isCapxulOperation(operation) ? { operation } : {}
-			},
-			...event === "$exception" ? { exception: projectException(properties, input.command, "SDK_DEFECT") } : {}
-		});
-	};
-	return {
-		capture,
-		captureIdentify,
-		client: { capture: (event, properties) => {
-			if (!enabled()) return;
-			if (event === "$exception" || event === "capxul_sdk_expected_outcome") {
-				captureSdkDiagnostic(event, properties);
-				return;
-			}
-			const catalog = isTelemetryEventName(event) ? TELEMETRY_EVENT_SCHEMAS[event] : void 0;
-			if (catalog === void 0) {
-				state.dropped += 1;
-				return;
-			}
-			const props = {};
-			const shape = catalog.fields.props;
-			const members = "fields" in shape ? [shape] : shape.members;
-			for (const member of members) for (const key of Object.keys(member.fields)) {
-				if (IDENTITY_KEYS.has(key)) continue;
-				const value = own(properties, key);
-				if (value !== void 0) props[key] = value;
-			}
-			const decoded = Schema.decodeUnknownOption(catalog)({
-				name: event,
-				props: {
-					...props,
-					...envelope
-				}
-			});
-			if (Option.isSome(decoded) && Queue.sizeUnsafe(queue) < 29) capture(event, { ...decoded.value.props });
-			else state.dropped += 1;
-		} }
-	};
-};
-/** The SDK's host observability for this invocation, joined to the command's trace. */
-const sdkObservation = (options) => {
-	const { input, client, enabled, deliveryBudget, traceparent } = options;
-	return postHogObservability(client, {
-		enabled,
-		engineeringEnabled: enabled,
-		engineeringPrivacy: "minimal",
-		engineeringDeliveryBudget: deliveryBudget,
-		capxulEnv: input.environment,
-		context: {
-			application: "capxul-cli",
-			...input.anonymousIdentity === void 0 ? {} : { anonymousId: input.anonymousIdentity.id },
-			release: input.cliVersion,
-			correlationId: input.invocationId,
-			journeyId: input.invocationId,
-			traceparent
-		}
-	});
-};
-//#endregion
 //#region src/platform/state-faults.ts
 var StateFileError = class extends Data.TaggedError("StateFileError") {
 	get message() {
@@ -69412,6 +69352,108 @@ function walletDetails(error) {
 	};
 }
 //#endregion
+//#region src/runtime/amount.ts
+/** Money as people read it, with at least two decimals: `550.00 USDC`. */
+const shownAmount = (amount) => {
+	const [number = "", symbol = ""] = formatAssetAmount(amount).split(" ");
+	const [integer = "0", fraction = ""] = number.split(".");
+	return `${integer}.${fraction.padEnd(2, "0")} ${symbol}`;
+};
+/** The number of `shownAmount`, for a table whose column names the asset: `1,000.00`. */
+const shownNumber = (amount) => {
+	try {
+		const shown = shownAmount(amount);
+		return shown.slice(0, shown.lastIndexOf(" "));
+	} catch {
+		return amount.value;
+	}
+};
+/** `USDC on Base Sepolia`, as `balance` names it. An asset this CLI does not know keeps its id. */
+const assetName = (asset) => {
+	try {
+		const { symbol, chainId } = requireAsset(toAssetId(asset));
+		return `${symbol} on ${networkName(chainId)}`;
+	} catch {
+		return asset;
+	}
+};
+/** A quantity in an asset's smallest units as a decimal string: `998230000` is `998.23`. */
+const fromBaseUnits = (raw, { decimals }) => {
+	const digits = raw.padStart(decimals + 1, "0");
+	const whole = digits.slice(0, digits.length - decimals);
+	const fraction = digits.slice(digits.length - decimals).replace(/0+$/u, "");
+	return fraction === "" ? whole : `${whole}.${fraction}`;
+};
+/** A signed raw-unit quantity as `shownNumber` shows it, or undefined for an asset this CLI does not know. */
+const shownBaseUnits = (asset, raw) => {
+	try {
+		const id = toAssetId(asset);
+		const sign = raw.startsWith("-") ? "-" : "";
+		const value = fromBaseUnits(raw.slice(sign.length), requireAsset(id));
+		return `${sign}${shownNumber({
+			asset: id,
+			value
+		})}`;
+	} catch {
+		return;
+	}
+};
+//#endregion
+//#region src/runtime/money-refusal.ts
+/** The asset a refusal names, by symbol or token address, among the ones this CLI knows. */
+const namedAsset = (details) => Object.values(TOKENS.BASE_SEPOLIA).map((id) => requireAsset(id)).find((asset) => asset.symbol === details.asset || typeof details.token === "string" && asset.tokenAddress.toLowerCase() === details.token.toLowerCase());
+/** INSUFFICIENT_BALANCE carries base units; a person reads `998.23 USDC`. */
+const insufficientBalance = (details) => {
+	const asset = details === void 0 ? void 0 : namedAsset(details);
+	const { available, required } = details ?? {};
+	if (asset === void 0 || typeof available !== "string" || typeof required !== "string" || !/^\d+$/u.test(available) || !/^\d+$/u.test(required)) return "The balance is too low for this payment.";
+	const shown = (raw) => shownAmount({
+		asset: asset.assetId,
+		value: fromBaseUnits(raw, asset)
+	});
+	return `You have ${shown(available)}; this needs ${shown(required)}.`;
+};
+const invalidRecipient = (reason) => typeof reason === "string" && /^[\w .,'@-]{1,120}$/u.test(reason) ? `The recipient was refused: ${reason.replace(/\.$/u, "")}.` : "The recipient was refused.";
+const requestKey = (reason) => /already used/u.test(String(reason)) ? "This request key was used for a different payment. Use a new --request-key, or send the same payment again to replay it." : "The request key was refused. Use a different --request-key.";
+/** An amount in major units, as a person reads it; `undefined` for anything else. */
+const heldAmount = (value) => {
+	if (!isRecord(value) || typeof value.asset !== "string" || typeof value.value !== "string") return void 0;
+	try {
+		return shownAmount({
+			asset: toAssetId(value.asset),
+			value: value.value
+		});
+	} catch {
+		return;
+	}
+};
+/**
+* Why an Organization's Budget refused a spend. `not_member` and
+* `condition_violation` are left out: permission commands raise them too, with
+* no more cause than the label, so a Budget sentence would mislead there.
+*/
+const BUDGET_REFUSAL = {
+	over_cap: "This payment is over the per-payment cap of your Budget.",
+	daily_cap: "This payment would go over your Budget's daily allowance.",
+	disallowed_recipient: "Your Budget does not allow paying this recipient."
+};
+const budgetRefusal = (details) => {
+	if (details.reason === "budget_exhausted") {
+		const left = heldAmount(details.remaining);
+		const needs = heldAmount(details.required);
+		return left === void 0 || needs === void 0 ? "Your Budget has run out for this period." : `Your Budget has ${left} left; this needs ${needs}.`;
+	}
+	return typeof details.reason === "string" ? BUDGET_REFUSAL[details.reason] : void 0;
+};
+/** The sentence for a payment refusal the backend explains in `details`, or nothing for any other. */
+const moneyRefusalMessage = (error) => {
+	if (error.code === "ROLE_PERMISSION_DENIED") return error.details === void 0 ? void 0 : budgetRefusal(error.details);
+	if (error.code === "INSUFFICIENT_BALANCE") return insufficientBalance(error.details);
+	if (error.code === "INVALID_RECIPIENT") return invalidRecipient(error.details?.reason);
+	if (error.code === "SUPERSEDED") return "Another attempt at this payment went first, so this one was not sent.";
+	if (error.code === "INVALID_INPUT" && error.details?.field === "requestKey") return requestKey(error.details.reason);
+};
+//#endregion
 //#region src/runtime/usage-failure.ts
 /** A command or flag name as the CLI declares them. */
 const NAME = /^[a-z][a-z0-9-]{0,63}$/u;
@@ -69457,23 +69499,65 @@ function helpFor(failures, command) {
 	] : ["capxul", "--help"];
 }
 /**
-* The command line with a mistyped command corrected: the typed path up to the
-* typo, the closest command, then the command words typed after it. IDs, flags
-* and values are left out, so nothing typed by mistake is echoed.
+* Commands #2294 removed, by the path a person types, and what replaced them.
+* The closest name by spelling would suggest a command that does something else
+* (`org use` is near `org me`), so these are named by hand. `takes` is an
+* argument the replacement needs that the old command also took.
+*/
+const REPLACED = {
+	"org use": {
+		to: ["use", "org"],
+		takes: "<handle>"
+	},
+	"org get": { to: ["org", "show"] },
+	"org status": { to: ["org", "show"] },
+	"account status": { to: ["account", "show"] },
+	telemetry: { to: ["config", "telemetry"] }
+};
+/**
+* The command line with a mistyped or removed command corrected: the typed
+* path up to the typo, the command to run instead, then the command words typed
+* after it that the tree still has, then the `--org` and `--env` typed (without
+* them `org payroll run` refuses bare). Other IDs, handles, flags and values are
+* left out, so nothing typed by mistake is echoed, and the line never carries a
+* value into a place that refuses it.
 */
-function correction(failures, args) {
+function correction(failures, args, kind) {
 	const unknown = failures.find((failure) => failure instanceof CliError.UnknownSubcommand);
-	const suggested = unknown?.suggestions.find((candidate) => NAME.test(candidate));
 	const parent = unknown?.parent ?? ["capxul"];
-	if (suggested === void 0 || !parent.every((part) => NAME.test(part))) return void 0;
+	if (unknown === void 0 || !parent.every((part) => NAME.test(part))) return void 0;
+	const replaced = REPLACED[[...parent.slice(1), unknown.subcommand].join(" ")];
+	const suggested = unknown.suggestions.find((candidate) => NAME.test(candidate));
+	const base = replaced === void 0 ? [...parent, suggested] : ["capxul", ...replaced.to];
+	if (!base.every((part) => part !== void 0)) return void 0;
 	const at = args.indexOf(unknown.subcommand);
-	const after = at === -1 ? [] : args.slice(at + 1);
+	const after = at === -1 || replaced?.takes !== void 0 ? [] : args.slice(at + 1);
 	const stop = after.findIndex((arg) => !NAME.test(arg));
-	return [
-		...parent,
-		suggested,
-		...stop === -1 ? after : after.slice(0, stop)
-	];
+	const carried = [];
+	for (const word of stop === -1 ? after : after.slice(0, stop)) {
+		if (kind !== void 0 && kind([
+			...base.slice(1),
+			...carried,
+			word
+		]) === void 0) break;
+		carried.push(word);
+	}
+	const argv = [...base, ...carried];
+	const scope = scopeArgs(args);
+	const hint = `Did you mean: ${[
+		...argv,
+		...replaced?.takes === void 0 ? [] : [replaced.takes],
+		...scope
+	].join(" ")}`;
+	const bare = replaced?.takes !== void 0 || kind?.(argv.slice(1)) === "group";
+	return {
+		argv: [
+			...argv,
+			...scope,
+			...bare ? ["--help"] : []
+		],
+		hint
+	};
 }
 /** The flag or argument a refusal names. */
 const fieldOf = (failures) => {
@@ -69483,18 +69567,18 @@ const fieldOf = (failures) => {
 		if (failure instanceof CliError.MissingArgument && NAME.test(failure.argument)) return failure.argument;
 	}
 };
-function usageFailure(error, command, args = []) {
+function usageFailure(error, command, args = [], kind) {
 	const failures = error instanceof CliError.ShowHelp ? error.errors : [error];
 	const missing = failures.flatMap((failure) => failure instanceof CliError.MissingOption && NAME.test(failure.option) ? [`--${failure.option}`] : []);
 	const sentences = [...missing.length === 0 ? [] : [`Missing required flag${missing.length === 1 ? "" : "s"}: ${[...new Set(missing)].join(", ")}.`], ...new Set(failures.flatMap((failure) => refusal(failure) ?? []))];
-	const corrected = correction(failures, args);
+	const corrected = correction(failures, args, kind);
 	const field = fieldOf(failures);
 	return {
 		code: "CLI_USAGE",
 		message: sentences.length === 0 ? "Invalid command or input." : sentences.join(" "),
 		...corrected === void 0 ? { next: helpFor(failures, command) } : {
-			hint: `Did you mean: ${corrected.join(" ")}`,
-			next: corrected
+			hint: corrected.hint,
+			next: corrected.argv
 		},
 		...field === void 0 ? {} : { field },
 		exitCode: 2,
@@ -69561,6 +69645,7 @@ const applicationMessage = (error, command, wallet) => {
 	if (error.code === "WRONG_STATE") return wrongStateMessage(error.details?.currentState, command);
 	if (error.code === "INVALID_INPUT" || error.code === "OTP_EXPIRED") return authCommand(command) ? authInputMessage(error) : "The input was refused. Check the command arguments.";
 	if (error.code === "CAPABILITY_UNAVAILABLE" && error.details?.reason === "backend-function-missing") return backendVersionMessage(error.details.path);
+	if (error.code === "UNKNOWN" && error.details?.reason === "backend-error-redacted") return redactedBackendMessage(error.details.requestId);
 	if (error.code === "RATE_LIMITED" && typeof error.details?.retryAfterMs === "number") return `The Capxul request was refused: RATE_LIMITED. Try again in ${Math.ceil(error.details.retryAfterMs / 1e3)} seconds.`;
 	if (isExpectedOutcome(error.code)) return `The Capxul request was refused: ${error.code}.`;
 	return `The Capxul request failed: ${error.code}.`;
@@ -69569,6 +69654,10 @@ const applicationMessage = (error, command, wallet) => {
 const backendVersionMessage = (path) => {
 	return `The backend does not have this command yet${typeof path === "string" && /^[a-z][A-Za-z0-9/_]*:[A-Za-z0-9_]+$/u.test(path) ? ` (no function ${path})` : ""}: it runs a different version from this CLI. Update the backend, or point CAPXUL_BOOTSTRAP_URL at a deployment that matches this CLI.`;
 };
+/** A deployed backend redacts its own errors (#2304): only its request id is left to quote. */
+const redactedBackendMessage = (requestId) => {
+	return `The backend refused the request and gave no detail.${typeof requestId === "string" && /^[A-Za-z0-9]{1,64}$/u.test(requestId) ? ` Quote request ${requestId} to Capxul support.` : ""} If the backend is newer than this CLI, updating the CLI may fix it.`;
+};
 /**
 * Exit codes by class: 1 a CLI defect, 2 refused input or state, 3 not signed
 * in, 4 not permitted, 5 failed, 6 any other refusal the operation names as an
@@ -69607,7 +69696,7 @@ const configurationFailure = (message) => new CliFailure({
 	exitCode: 2,
 	outcome: "refused"
 });
-function classifyFailure(cause, command, args) {
+function classifyFailure(cause, command, args, kind) {
 	const error = Cause.squash(cause);
 	if (Cause.hasInterruptsOnly(cause) || Terminal.isQuitError(error)) return {
 		code: "CANCELLED",
@@ -69617,7 +69706,7 @@ function classifyFailure(cause, command, args) {
 	};
 	if (error instanceof CliFailure) return error;
 	if (error instanceof StateFileError) return storageFailure(error);
-	if (CliError.isCliError(error)) return usageFailure(error, command, args);
+	if (CliError.isCliError(error)) return usageFailure(error, command, args, kind);
 	if (isCapxulError(error)) {
 		const wallet = walletDetails(error);
 		const details = {
@@ -69627,7 +69716,7 @@ function classifyFailure(cause, command, args) {
 		const signIn = error.code === "NOT_AUTHENTICATED" && wallet === void 0 && error.details?.field !== "publishableKey";
 		return {
 			code: error.code,
-			message: applicationMessage(error, command, wallet),
+			message: moneyRefusalMessage(error) ?? applicationMessage(error, command, wallet),
 			...signIn ? { next: SIGN_IN$1 } : {},
 			...details.field === void 0 ? {} : { field: details.field },
 			...error.mode === void 0 ? {} : { mode: error.mode },
@@ -69686,6 +69775,358 @@ function parsedCommand(cause) {
 	return CliError.isCliError(error) && error._tag === "ShowHelp" ? error.commandPath.slice(1).join(".") || "capxul" : "capxul";
 }
 //#endregion
+//#region src/runtime/command-metadata.ts
+var CliCommandMetadata = class extends Context.Service()("capxul-cli/CommandMetadata") {};
+const collectionControl = (name) => name === "config" || name === "config.telemetry" || name.startsWith("config.telemetry.");
+/** Resolve only a complete path supplied by the native parser. */
+function commandAtPath(root, path) {
+	if (path[0] !== root.name) return void 0;
+	let selected = root;
+	for (const part of path.slice(1)) {
+		const child = selected.subcommands.flatMap((group) => group.commands).find((candidate) => candidate.name === part || candidate.alias === part);
+		if (child === void 0) return void 0;
+		selected = child;
+	}
+	return selected;
+}
+/** What the tree has at a path of command words (without the root's name). */
+const pathKind = (root) => (path) => {
+	const found = commandAtPath(root, [root.name, ...path]);
+	return found === void 0 ? void 0 : found.subcommands.length > 0 ? "group" : "command";
+};
+const validateNativeScope = (input) => {
+	if (typeof input === "object" && input !== null && "orgs" in input && Array.isArray(input.orgs) && input.orgs.every((id) => typeof id === "string") && new Set(input.orgs).size > 1) return Effect.fail(new CliError.InvalidValue({
+		option: "org",
+		value: "multiple IDs",
+		expected: "one exact Organization ID",
+		kind: "flag"
+	}));
+	return Effect.void;
+};
+/** Keep the native grammar and validate scope without business actions. */
+function nativeInputTree(node) {
+	const input = Command.withHandler(node, validateNativeScope);
+	const children = node.subcommands.flatMap((group) => {
+		const commands = group.commands.map(nativeInputTree);
+		return group.group === void 0 ? commands : [{
+			group: group.group,
+			commands
+		}];
+	});
+	return Command.withSubcommands(input, children);
+}
+/** The command whose metadata is named `name`, searched from `root`. */
+const commandNamed = (root, name) => {
+	const metadata = Context.getOption(root.annotations, CliCommandMetadata);
+	if (Option.isSome(metadata) && metadata.value.name === name && root.subcommands.length === 0) return root;
+	for (const child of root.subcommands.flatMap((group) => group.commands)) {
+		const found = commandNamed(child, name);
+		if (found !== void 0) return found;
+	}
+};
+/** The flag inside `param` when it takes one value: nothing in it repeats, and it is no switch. */
+const oneValue = (param) => {
+	if (Param.isSingle(param)) return param.primitiveType._tag === "Boolean" ? void 0 : param;
+	if (param._tag === "Variadic") return void 0;
+	const inner = readField(param, "param");
+	return Param.isParam(inner) ? oneValue(inner) : void 0;
+};
+/**
+* The names of `node`'s flags that take one value, as typed (`--name`, `-n`).
+* The parser keeps the first of a repeated one and drops the rest without a
+* word, so the caller refuses a repeat. `config` is the command's own definition.
+*/
+const singleValueFlags = (node) => {
+	const flags = readField(readField(node, "config"), "flags");
+	return (Array.isArray(flags) ? flags : []).flatMap((flag) => {
+		const single = Param.isParam(flag) ? oneValue(flag) : void 0;
+		return single === void 0 ? [] : [`--${single.name}`, ...single.aliases.map((alias) => alias.length === 1 ? `-${alias}` : `--${alias}`)];
+	});
+};
+/**
+* A refusal naming the first flag that takes one value and was typed more than
+* once: the parser keeps the first `--timeout-seconds` and `--fields` keeps the
+* last, both silently. `--fields` and `--env` are global flags.
+*/
+const repeatedFlag = (root, name, args) => {
+	const node = root === void 0 ? void 0 : commandNamed(root, name);
+	const end = args.indexOf("--");
+	const typed = end < 0 ? args : args.slice(0, end);
+	const repeated = [
+		...node === void 0 ? [] : singleValueFlags(node),
+		"--fields",
+		"--env"
+	].find((flag) => typed.filter((arg) => arg === flag || arg.startsWith(`${flag}=`)).length > 1);
+	return repeated === void 0 ? void 0 : new CliFailure({
+		code: "CLI_USAGE",
+		message: `Provide ${repeated} once.`,
+		field: repeated.replace(/^-+/u, ""),
+		exitCode: 2,
+		outcome: "refused"
+	});
+};
+function metadataAtPath(root, path) {
+	let selected = root;
+	for (const part of path.slice(1)) {
+		const child = selected.subcommands.flatMap((group) => group.commands).find((command) => command.name === part || command.alias === part);
+		if (child === void 0) break;
+		selected = child;
+	}
+	const metadata = Context.getOption(selected.annotations, CliCommandMetadata);
+	return Option.isSome(metadata) && CLI_COMMAND_NAMES.includes(metadata.value.name) ? metadata.value : {
+		name: "unknown",
+		capability: "cli",
+		observation: "command"
+	};
+}
+//#endregion
+//#region src/observability/projection.ts
+const codes = [
+	...CAPXUL_ERROR_CODES,
+	"CLI_USAGE",
+	"CLI_CONFIG",
+	"CLI_STORAGE",
+	"CLI_DEFECT",
+	"CLI_DEADLINE"
+];
+/** A known Capxul or CLI error code, never a free-form string from a source. */
+const safeCode = (value) => codes.find((code) => code === value);
+/** Read one own data property without running a getter on a hostile value. */
+const own = (value, key) => {
+	if (typeof value !== "object" || value === null) return void 0;
+	try {
+		return Object.getOwnPropertyDescriptor(value, key)?.value;
+	} catch {
+		return;
+	}
+};
+/** The numeric and enumerated SDK failure facts a diagnostic log may keep. */
+function projectSdkProperties(properties) {
+	const output = {};
+	for (const key of [
+		"chainId",
+		"chain_id",
+		"durationMs",
+		"duration_ms",
+		"http_status",
+		"retry_count"
+	]) {
+		const value = own(properties, key);
+		if (typeof value === "number" && Number.isFinite(value) && value >= 0) output[key] = value;
+	}
+	for (const key of [
+		"error_kind",
+		"error_code",
+		"reason_code"
+	]) {
+		const value = safeCode(own(properties, key));
+		if (value !== void 0) output[key] = value;
+	}
+	const operation = own(properties, "operation");
+	if (isCapxulOperation(operation)) output.operation = operation;
+	const failureMode = FAILURE_MODES$1.find((mode) => mode === own(properties, "failure_mode"));
+	if (failureMode !== void 0) output.failure_mode = failureMode;
+	return output;
+}
+/** A source-only `$exception`: basenames, function names and lines, never messages or paths. */
+function projectException(properties, command, kind = "CLI_DEFECT") {
+	const sanitized = sanitizePostHogBrowserEvent({
+		event: "$exception",
+		properties: { ...properties }
+	}).properties;
+	const exceptions = own(sanitized, "$exception_list");
+	const stacktrace = own(Array.isArray(exceptions) ? exceptions[0] : void 0, "stacktrace");
+	const rawFrames = own(stacktrace, "frames");
+	const frames = (Array.isArray(rawFrames) ? rawFrames : []).slice(0, 12).map((frame) => {
+		const filename = own(frame, "filename");
+		const basename = typeof filename === "string" ? filename.split(/[\\/]/u).at(-1)?.split(/[?#]/u)[0] : void 0;
+		const name = own(frame, "function");
+		return {
+			platform: "node:javascript",
+			filename: `capxul-cli:///${basename !== void 0 && /^[A-Za-z0-9._-]{1,96}$/u.test(basename) ? basename : "boundary"}`,
+			function: typeof name === "string" && /^[A-Za-z_$<>][A-Za-z0-9_$.<>-]{0,95}$/u.test(name) ? name : "<anonymous>",
+			lineno: boundedLine(own(frame, "lineno")),
+			colno: boundedLine(own(frame, "colno"))
+		};
+	});
+	return {
+		$exception_type: kind,
+		$exception_message: kind === "CLI_DEFECT" ? "CLI command failed" : "SDK operation failed",
+		$exception_level: "error",
+		$exception_fingerprint: `cli.${command}.${kind}:${frames[0]?.filename ?? "boundary"}:${frames[0]?.function ?? "unknown"}`,
+		$issue_name: `${kind === "CLI_DEFECT" ? "CLI" : "SDK"} ${command} defect`,
+		$exception_list: [{
+			type: kind,
+			value: kind === "CLI_DEFECT" ? "CLI command failed" : "SDK operation failed",
+			mechanism: {
+				handled: true,
+				type: kind === "CLI_DEFECT" ? "capxul_cli_boundary" : "capxul_cli_sdk_boundary"
+			},
+			stacktrace: {
+				type: "raw",
+				frames
+			}
+		}]
+	};
+}
+const boundedLine = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= 1e7 ? value : null;
+//#endregion
+//#region src/observability/capture.ts
+const isTelemetryEventName = (event) => Object.hasOwn(TELEMETRY_EVENT_SCHEMAS, event);
+const CAPTURE_BYTES = 8192;
+const textEncoder = new TextEncoder();
+const IDENTITY_KEYS = /* @__PURE__ */ new Set([
+	"actor_id",
+	"actor_kind",
+	"auth_user_id",
+	"anonymous_id",
+	"cli_identity_kind",
+	"distinct_id",
+	"$groups"
+]);
+/** The bounded PostHog capture queue writers for one invocation. Nothing here sends. */
+const makeCaptures = (options) => {
+	const { input, token, envelope, enabled, clock, queue, state } = options;
+	const enqueue = (body) => {
+		if (textEncoder.encode(body).byteLength > CAPTURE_BYTES || !Queue.offerUnsafe(queue, body)) state.dropped += 1;
+	};
+	const capture = (event, properties, identity) => {
+		if (!enabled()) {
+			state.dropped += 1;
+			return;
+		}
+		const occurredAt = identity?.observedAt ?? clock.currentTimeMillisUnsafe();
+		const record = sanitizePostHogBrowserEvent({
+			event,
+			properties: {
+				...properties,
+				...envelope,
+				occurred_at: occurredAt,
+				...state.nativeContext
+			}
+		});
+		if (event === "access_recovery_completed") {
+			const checked = Schema.decodeUnknownOption(TELEMETRY_EVENT_SCHEMAS.access_recovery_completed)({
+				name: event,
+				props: properties
+			});
+			if (Option.isSome(checked) && checked.value.name === "access_recovery_completed") record.properties.recovery = checked.value.props.recovery;
+		}
+		enqueue(JSON.stringify({
+			api_key: token,
+			...record,
+			uuid: identity?.eventId ?? crypto.randomUUID(),
+			timestamp: new Date(occurredAt).toISOString(),
+			properties: {
+				...record.properties,
+				distinct_id: input.anonymousIdentity?.id ?? input.invocationId,
+				$process_person_profile: false
+			}
+		}));
+	};
+	/**
+	* Join this epoch's anonymous history to the person AUTH verified.
+	*
+	* This is a PostHog lifecycle event, not a catalog event: it carries the
+	* person as `distinct_id` and the epoch as `$anon_distinct_id`, and
+	* deliberately omits `$process_person_profile` so the merge is processed —
+	* every catalog event here sets it false, which is what keeps those events off
+	* the person until this record exists.
+	*
+	* The binding's own stored `eventId` is the record UUID, so PostHog
+	* deduplicates a replayed merge. The same idiom `cli_first_used` uses.
+	*
+	* No `$set` traits: identify traits bypass the per-event redactor, and this
+	* module has no pre-minimized person fact to send. The merge is the whole
+	* payload.
+	*/
+	const captureIdentify = (authUserId, anonymousId, eventId, occurredAt) => {
+		if (!enabled()) {
+			state.dropped += 1;
+			return;
+		}
+		enqueue(JSON.stringify({
+			api_key: token,
+			event: "$identify",
+			uuid: eventId,
+			timestamp: new Date(occurredAt).toISOString(),
+			properties: {
+				capxul_env: input.environment,
+				distinct_id: authUserId,
+				$anon_distinct_id: anonymousId
+			}
+		}));
+	};
+	const captureSdkDiagnostic = (event, properties) => {
+		const code = safeCode(own(properties, "error_kind")) ?? (event === "$exception" ? "UNKNOWN" : void 0);
+		const operation = own(properties, "operation");
+		if (code === void 0 || state.sdkDiagnostics.length >= 32) {
+			state.dropped += 1;
+			return;
+		}
+		state.sdkDiagnostics.push({
+			log: {
+				...projectSdkProperties(properties),
+				error_code: code,
+				...isCapxulOperation(operation) ? { operation } : {}
+			},
+			...event === "$exception" ? { exception: projectException(properties, input.command, "SDK_DEFECT") } : {}
+		});
+	};
+	return {
+		capture,
+		captureIdentify,
+		client: { capture: (event, properties) => {
+			if (!enabled()) return;
+			if (event === "$exception" || event === CAPXUL_SDK_EXPECTED_OUTCOME_EVENT) {
+				captureSdkDiagnostic(event, properties);
+				return;
+			}
+			const catalog = isTelemetryEventName(event) ? TELEMETRY_EVENT_SCHEMAS[event] : void 0;
+			if (catalog === void 0) {
+				state.dropped += 1;
+				return;
+			}
+			const props = {};
+			const shape = catalog.fields.props;
+			const members = "fields" in shape ? [shape] : shape.members;
+			for (const member of members) for (const key of Object.keys(member.fields)) {
+				if (IDENTITY_KEYS.has(key)) continue;
+				const value = own(properties, key);
+				if (value !== void 0) props[key] = value;
+			}
+			const decoded = Schema.decodeUnknownOption(catalog)({
+				name: event,
+				props: {
+					...props,
+					...envelope
+				}
+			});
+			if (Option.isSome(decoded) && Queue.sizeUnsafe(queue) < 29) capture(event, { ...decoded.value.props });
+			else state.dropped += 1;
+		} }
+	};
+};
+/** The SDK's host observability for this invocation, joined to the command's trace. */
+const sdkObservation = (options) => {
+	const { input, client, enabled, deliveryBudget, traceparent } = options;
+	return postHogObservability(client, {
+		enabled,
+		engineeringEnabled: enabled,
+		engineeringPrivacy: "minimal",
+		engineeringDeliveryBudget: deliveryBudget,
+		capxulEnv: input.environment,
+		context: {
+			application: "capxul-cli",
+			...input.anonymousIdentity === void 0 ? {} : { anonymousId: input.anonymousIdentity.id },
+			release: input.cliVersion,
+			correlationId: input.invocationId,
+			journeyId: input.invocationId,
+			traceparent
+		}
+	});
+};
+//#endregion
 //#region src/platform/state-files.ts
 const Settings = Schema.Struct({
 	version: Schema.Literal(1),
@@ -70518,17 +70959,24 @@ function observeInvocation(input, work) {
 //#region src/runtime/output.ts
 const writeStdout = (text) => Effect.flatMap(Stdio.Stdio, (stdio) => Stream.run(Stream.make(text), stdio.stdout()));
 const writeStderr = (text) => Effect.flatMap(Stdio.Stdio, (stdio) => Stream.run(Stream.make(text), stdio.stderr()));
+const showsProgress = (reader) => Effect.gen(function* () {
+	if (reader.mode === "json") return true;
+	return reader.stderrTty === true && (yield* (yield* Stdio.Stdio).stdoutIsTerminal);
+});
+/** A state or recovery line while the work has not failed, under `withWaiting`'s rule. */
+const writeProgress = (reader, text) => Effect.flatMap(showsProgress(reader), (shown) => shown ? writeStderr(text) : Effect.void);
 /** Wrap pending work only. Keep terminal prompts outside this scope. */
 const withWaiting = (work, options) => Effect.scoped(Effect.gen(function* () {
 	const stdio = yield* Stdio.Stdio;
-	const terminal = options.stderrTty === true && (yield* stdio.stdoutIsTerminal);
-	if (options.mode === "human" && !terminal) return yield* work;
-	yield* writeStderr(options.mode === "json" ? `${JSON.stringify({
-		type: "cli.waiting",
-		label: options.label,
-		status: "waiting"
-	})}\n` : `Waiting: ${terminalText(options.label)}\n`);
-	if (!(options.mode === "human" && options.tty && !options.ci)) return yield* work;
+	if (!(yield* showsProgress(options))) return yield* work;
+	if (!(options.mode === "human" && options.tty && !options.ci)) {
+		yield* writeStderr(options.mode === "json" ? `${JSON.stringify({
+			type: "cli.waiting",
+			label: options.label,
+			status: "waiting"
+		})}\n` : `Waiting: ${terminalText(options.label)}\n`);
+		return yield* work;
+	}
 	const clear = "\r\x1B[2K";
 	const frames = [
 		"⠋",
@@ -70554,20 +71002,27 @@ const withWaiting = (work, options) => Effect.scoped(Effect.gen(function* () {
 function renderResult(mode, envelope, lines = [], rawHuman) {
 	const pretty = process.stdout.isTTY;
 	if (mode === "json") return writeStdout(`${JSON.stringify(envelope, null, pretty ? 2 : void 0)}\n`);
-	return envelope.outcome === "succeeded" ? writeStdout(rawHuman ?? `${(pretty ? lines.map(readableLine) : lines).join("\n")}\n`) : Effect.flatMap(Config.String("NO_COLOR").pipe(Config.withDefault(""), Effect.orElseSucceed(() => "")), (noColor) => writeStderr(errorText(envelope.error, process.stderr.isTTY && noColor === "")));
+	return envelope.outcome === "succeeded" ? writeStdout(rawHuman ?? `${(pretty ? lines.map(readableLine) : lines).join("\n")}\n`) : Effect.flatMap(Config.String("NO_COLOR").pipe(Config.withDefault(""), Effect.orElseSucceed(() => "")), (noColor) => writeStderr(errorText(envelope.error, process.stderr.isTTY && noColor === "", errorRef(envelope.error.details, envelope.invocationId))));
 }
 /** A shell word, quoted only when the shell would read it differently. */
 const shellWord = (value) => /^[\w@%+=:,./-]+$/u.test(value) ? value : shellArgument(value);
 /**
+* The id a person quotes to support: the backend's request id, else its
+* correlation id, else this run's invocation ID. Each is validated upstream.
+*/
+const errorRef = (details, invocationId) => details?.requestId ?? details?.correlationId ?? invocationId ?? void 0;
+/**
 * A refusal for a person: one line (red on a terminal) for what happened, and
-* one for what fixes it. They share a line when both fit in 80 columns.
+* one for what fixes it. They share a line when both fit in 80 columns. The
+* last line is the dim `ref <id>`, unless the message already quotes that id.
 */
-const errorText = (error, color) => {
+const errorText = (error, color, ref) => {
 	const what = `✗ ${error.message}`;
 	const fix = error.hint ?? (error.next === void 0 ? void 0 : `Try: ${error.next.argv.map(shellWord).join(" ")}`);
 	const painted = color ? `\u001b[31m${what}\u001b[0m` : what;
-	if (fix === void 0) return `${painted}\n`;
-	return !what.includes("\n") && what.length + fix.length < 80 ? `${painted} ${fix}\n` : `${painted}\n${fix}\n`;
+	const body = fix === void 0 ? `${painted}\n` : !what.includes("\n") && what.length + fix.length < 80 ? `${painted} ${fix}\n` : `${painted}\n${fix}\n`;
+	if (ref === void 0 || error.message.includes(ref)) return body;
+	return `${body}${color ? `\u001b[2mref ${ref}\u001b[0m` : `ref ${ref}`}\n`;
 };
 const readableLine = (line) => {
 	try {
@@ -70580,8 +71035,8 @@ const terminalText = (value) => value.replace(/[\p{Cc}\p{Cf}]/gu, (character) =>
 const shellArgument = (value) => `'${value.replaceAll("'", "'\"'\"'")}'`;
 //#endregion
 //#region src/runtime/version.ts
-const cliVersion = "4.20.0-beta.27";
-const sdkVersion = "4.20.0-beta.27";
+const cliVersion = "4.20.0-beta.28";
+const sdkVersion = "4.20.0-beta.28";
 const ReleaseVersion = Schema.String.check(Schema.isMaxLength(256), Schema.isPattern(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/u)).pipe(Schema.brand("CliReleaseVersion"));
 const parts = (version) => {
 	const [core = "", ...prerelease] = version.split("+")[0].split("-");
@@ -70788,6 +71243,29 @@ const readFields = (value) => {
 	const fields = value.split(",").map((field) => field.trim()).filter((field) => field !== "");
 	return fields.length === 0 || fields.some((field) => !/^[\w-]+(?:\.[\w-]+)*$/u.test(field)) ? void 0 : fields;
 };
+/**
+* What `--json` returns from a command that moves money: the open approval,
+* before anyone approves it. A test holds this to `handOver`'s real result.
+*/
+const APPROVAL$1 = {
+	status: null,
+	approvalId: null,
+	approvalUrl: null,
+	paymentIds: null,
+	expiresAt: null,
+	next: { argv: null }
+};
+/**
+* The commands that move money, each with the result it declares. A typo in
+* `--fields` must not cost an approval, so these check `--fields` against the
+* declared result before they run. `capxul schema` marks the same four.
+*/
+const MONEY_RESULTS = {
+	"payment.send": APPROVAL$1,
+	"payment.retry": APPROVAL$1,
+	"inbox.pay": APPROVAL$1,
+	"org.payroll.run": APPROVAL$1
+};
 const fieldsRefusal = (message) => new CliFailure({
 	code: "CLI_USAGE",
 	message,
@@ -70795,6 +71273,64 @@ const fieldsRefusal = (message) => new CliFailure({
 	exitCode: 2,
 	outcome: "refused"
 });
+/** A page is the list shape, `{ items, nextCursor }`; any other `items` is an ordinary field. */
+const isPage = (data) => isRecord(data) && Array.isArray(data.items) && Object.hasOwn(data, "nextCursor");
+/** The records `--fields` picks from: each item of a page or list, else the data itself. */
+const recordsOf = (data) => (Array.isArray(data) ? data : isPage(data) ? data.items : [data]).filter(isRecord);
+const has = (value, [key, ...rest]) => key !== void 0 && isRecord(value) && Object.hasOwn(value, key) && (rest.length === 0 || has(value[key], rest));
+/** Edit distance, for "did you mean". */
+const distance = (a, b) => {
+	let row = Array.from({ length: b.length + 1 }, (_, index) => index);
+	for (let i = 0; i < a.length; i++) {
+		const next = [i + 1];
+		for (let j = 0; j < b.length; j++) next.push(Math.min(row[j + 1] + 1, next[j] + 1, row[j] + (a[i] === b[j] ? 0 : 1)));
+		row = next;
+	}
+	return row[b.length];
+};
+/** The fields at the deepest level `path` reaches in any record, and those a letter or two off it. */
+const nearby = (records, path) => {
+	let depth = path.length - 1;
+	while (depth > 0 && !records.some((record) => has(record, path.slice(0, depth)))) depth--;
+	const parent = path.slice(0, depth);
+	const names = [...new Set(records.flatMap((record) => {
+		const inner = parent.reduce((value, key) => isRecord(value) ? value[key] : void 0, record);
+		return isRecord(inner) ? Object.keys(inner) : [];
+	}))].filter((name) => /^[\w-]+$/u.test(name));
+	const typed = path.slice(depth).join(".").toLowerCase();
+	const close = names.filter((name) => {
+		const apart = distance(name.toLowerCase(), typed);
+		return apart <= 2 && apart * 2 < Math.max(name.length, typed.length);
+	});
+	const named = (name) => [...parent, name].join(".");
+	return {
+		names: names.map(named),
+		close: close.map(named)
+	};
+};
+/**
+* The first requested field the result cannot give, as a refusal that names it,
+* the closest real field and the fields there are. Against a command's declared
+* result (`declared`), any other name is unknown. Against the result itself, a
+* name no record has is refused only as a near miss of one it does have
+* (`stauts`): an optional field this result lacks (`execution` on a Payment
+* that has none) is left out, as `jq` would. A field some records lack, a
+* page's own fields and an empty page pass.
+*/
+const unknownFieldRefusal = (data, fields, declared = false) => {
+	const records = recordsOf(data);
+	if (records.length === 0) return void 0;
+	const pageKeys = isPage(data) ? Object.keys(data) : [];
+	for (const path of fields.map((field) => field.split("."))) {
+		if (records.some((record) => has(record, path))) continue;
+		if (path.length === 1 && pageKeys.includes(path[0])) continue;
+		const { names, close } = nearby(records, path);
+		if (!declared && close.length === 0) continue;
+		const suggestion = close.length === 0 ? "" : ` Did you mean ${close.map((name) => `"${name}"`).join(" or ")}?`;
+		const list = `${names.slice(0, 30).join(", ")}${names.length > 30 ? ", …" : ""}.`;
+		return fieldsRefusal(!declared ? `Field "${path.join(".")}" is not in this result.${suggestion} Fields in this result: ${list}` : `Unknown field "${path.join(".")}".${suggestion} ${names.length === 0 ? "This result has no fields to pick." : `Valid fields: ${list}`}`);
+	}
+};
 const copyPath = (from, to, [key, ...rest]) => {
 	if (key === void 0 || !Object.hasOwn(from, key)) return;
 	const value = from[key];
@@ -70808,14 +71344,14 @@ const copyPath = (from, to, [key, ...rest]) => {
 	copyPath(value, inner, rest);
 };
 /**
-* Keep the named fields; `amount.value` reaches inside `amount`. A list keeps
-* its page fields (`nextCursor`) and picks from each item. A field the data
+* Keep the named fields; `amount.value` reaches inside `amount`. A page keeps
+* its own fields (`nextCursor`) and picks from each item. A field the data
 * lacks is left out, as `jq` would.
 */
 const pickFields = (data, fields) => {
 	if (Array.isArray(data)) return data.map((item) => pickFields(item, fields));
 	if (!isRecord(data)) return data;
-	if (Array.isArray(data.items)) return {
+	if (isPage(data)) return {
 		...data,
 		items: data.items.map((item) => pickFields(item, fields))
 	};
@@ -70907,44 +71443,14 @@ const withoutOrganization = (saved, origin) => {
 	};
 };
 //#endregion
-//#region src/runtime/format.ts
-const jsonFlag = Flag.Boolean("json").pipe(Flag.withDefault(false), Flag.withDescription("Print a versioned JSON result"));
-const JsonOutput = GlobalFlag.Setting("json")({ flag: jsonFlag });
-/** `--org <handle>` for one command. Commands resolve it through `#auth/actor`. */
-const OrganizationFlag = GlobalFlag.Setting("org")({ flag: Flag.String("org").pipe(Flag.withMetavar("<handle>"), Flag.withDescription("act as this organization for one command"), Flag.optional) });
-/** `--fields <a,b>`: the JSON result keeps only these fields of `data`. */
-const FieldsFlag = GlobalFlag.Setting("fields")({ flag: Flag.String("fields").pipe(Flag.withMetavar("<a,b>"), Flag.withDescription("choose which JSON fields come back"), Flag.optional) });
-/** `--env <name>` for one command. The runner reads it with the other environment sources. */
-const EnvironmentFlag = GlobalFlag.Setting("env")({ flag: Flag.String("env").pipe(Flag.withMetavar("<name>"), Flag.withDescription("use this environment for one command"), Flag.optional) });
-/** Local diagnostics require an explicit debug level. */
-const localDiagnosticsEnabled = (args) => {
-	const terminator = args.indexOf("--");
-	const flags = terminator < 0 ? args : args.slice(0, terminator);
-	let level;
-	for (const [index, arg] of flags.entries()) if (arg.startsWith("--log-level=")) level = arg.slice(12);
-	else if (arg.startsWith("--logLevel=")) level = arg.slice(11);
-	else if (arg === "--log-level" || arg === "--logLevel") level = flags[index + 1];
-	return level === "debug";
-};
-/** Negotiate only the global format before native CLI error rendering.
-* Native Flag decoding remains the value authority; the command runner parses everything else.
+//#region src/runtime/root-command.ts
+/** The command tree `capxul` runs, for the commands that describe it (`capxul schema`). */
+var RootCommand = class extends Context.Service()("capxul-cli/RootCommand") {};
+/**
+* The tree, when the entry provided it. Reading it as optional keeps it out of
+* every command's requirements; only `schema` asks, and the entry always gives it.
 */
-const outputMode = (args) => Effect.gen(function* () {
-	const terminator = args.indexOf("--");
-	const flags = terminator < 0 ? args : args.slice(0, terminator);
-	const values = [];
-	for (const [index, arg] of flags.entries()) if (arg === "--no-json") values.push("false");
-	else if (arg.startsWith("--json=")) values.push(arg.slice(7));
-	else if (arg === "--json") {
-		const next = flags[index + 1];
-		const value = next === void 0 ? "true" : yield* Primitive.Boolean.parse(next).pipe(Effect.as(next), Effect.orElseSucceed(() => "true"));
-		values.push(value);
-	}
-	return yield* jsonFlag.parse({
-		flags: { json: values },
-		arguments: []
-	}).pipe(Effect.map(([, json]) => json ? "json" : "human"), Effect.orElseSucceed(() => values.includes("true") ? "json" : "human"));
-});
+const rootCommand = Effect.flatMap(Effect.serviceOption(RootCommand), (root) => Option.isSome(root) ? Effect.succeed(root.value) : Effect.die("RootCommand is not provided"));
 //#endregion
 //#region src/runtime/run-command.ts
 var CliRuntime = class extends Context.Service()("capxul-cli/Runtime") {};
@@ -71017,14 +71523,28 @@ const runInvocation = (runtime, metadata, kind, work, network = false) => Effect
 		return notice === "" ? Effect.void : writeStderr(notice).pipe(Effect.ignoreCause);
 	}));
 });
-/** `--fields`, checked before the command runs: a JSON choice that names at least one field. */
-const requestedFields = (runtime) => Effect.gen(function* () {
+/**
+* The flags, checked before the command runs: a flag that takes one value is
+* typed once. `--fields` is a JSON choice that names at least one field. A
+* command that moves money also checks the names against its declared
+* result, so a typo is refused before anything is prepared.
+*/
+const requestedFields = (runtime, name) => Effect.gen(function* () {
+	const root = Option.getOrUndefined(yield* Effect.serviceOption(RootCommand));
+	const repeated = repeatedFlag(root, name, runtime.args ?? []);
+	if (repeated !== void 0) return yield* repeated;
 	const value = flagValue(runtime.args ?? [], "fields");
 	if (value === void 0) return void 0;
 	if (runtime.mode !== "json") return yield* fieldsRefusal("--fields chooses JSON fields. Add --json.");
 	const fields = readFields(value);
 	if (fields === void 0) return yield* fieldsRefusal("Provide --fields as names separated by commas, like id,status.");
-	return fields;
+	const declared = MONEY_RESULTS[name];
+	const unknown = declared === void 0 ? void 0 : unknownFieldRefusal(declared, fields, true);
+	if (unknown !== void 0) return yield* unknown;
+	return {
+		fields,
+		declared: declared !== void 0
+	};
 });
 /** Commands that print where you are themselves, or change who you are. */
 const selfLocating = (name) => name === "whoami" || name === "use" || name.startsWith("use.") || name.startsWith("auth.");
@@ -71040,10 +71560,13 @@ const writeHeader = (config, runtime, scope = "context") => Effect.gen(function*
 const runCommand = (options, work) => Effect.gen(function* () {
 	const runtime = yield* CliRuntime;
 	return yield* runInvocation(runtime, options, "command", (host, onFinalize) => Effect.gen(function* () {
-		const fields = yield* requestedFields(runtime);
+		const requested = yield* requestedFields(runtime, options.name);
+		const fields = requested?.fields;
 		const config = yield* loadConfigWith(options.environment ?? flagValue(runtime.args ?? [], "env"));
 		if (runtime.mode === "human" && !selfLocating(options.name)) yield* writeHeader(config, runtime, actorScope$1(options.name));
 		const result = yield* work(config, host, onFinalize);
+		const unknown = fields === void 0 || requested?.declared === true ? void 0 : unknownFieldRefusal(result.data, fields);
+		if (unknown !== void 0) return yield* unknown;
 		yield* renderResult(runtime.mode, {
 			version: 1,
 			command: options.name,
@@ -71056,7 +71579,7 @@ const runCommand = (options, work) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/account/subcommands/shared.ts
-const emailFlag$10 = Flag.String("email").pipe(Flag.optional);
+const emailFlag$10 = Flag.String("email").pipe(Flag.withDescription(FLAG_HELP.email), Flag.optional);
 const names$8 = {
 	root: "account",
 	show: "account.show",
@@ -71234,6 +71757,22 @@ const openSessionRecord = (config, email) => Effect.gen(function* () {
 	};
 });
 //#endregion
+//#region src/auth/bootstrap-cache.ts
+const bootstrapCache = (config, run) => {
+	const record = privateRecordScope(config, "bootstrap", "application");
+	return {
+		load: () => run(Effect.gen(function* () {
+			const { directory, scope } = yield* record;
+			const value = yield* readPrivateRecord(directory, scope);
+			return value === null ? null : JSON.parse(value);
+		})),
+		save: (body) => run(Effect.gen(function* () {
+			const { directory, scope } = yield* record;
+			yield* writePrivateRecord(directory, scope, JSON.stringify(body));
+		}))
+	};
+};
+//#endregion
 //#region src/auth/current-session.ts
 const CurrentSession = Schema.Struct({
 	version: Schema.Literal(1),
@@ -71277,12 +71816,23 @@ const forgetCurrentSession = (config, email, stillCleared) => Effect.gen(functio
 });
 //#endregion
 //#region src/auth/input.ts
-const inputRequired = (message) => new CliFailure({
+/** A refusal of the input: `field` is the flag or argument refused, `next` the command that fixes it. */
+const inputRequired = (message, fix = {}) => new CliFailure({
 	code: "CLI_USAGE",
 	message,
+	...fix,
 	exitCode: 2,
 	outcome: "refused"
 });
+/** An Organization command with none chosen: `org list` finds the handle to choose. */
+const organizationRequired = () => inputRequired("Provide --org, or choose one with: capxul use org <handle>", {
+	field: "org",
+	next: [
+		"capxul",
+		"org",
+		"list"
+	]
+});
 const readEmail = (email) => Effect.gen(function* () {
 	const runtime = yield* CliRuntime;
 	if (email === void 0) {
@@ -71418,7 +71968,7 @@ const withAccountSignerProgress = (client, work) => Effect.scoped(Effect.gen(fun
 	const observe = (status) => {
 		if (closed || status === previous) return;
 		previous = status;
-		writes = writes.then(() => run(writeStderr(runtime.mode === "json" ? `${JSON.stringify({
+		writes = writes.then(() => run(writeProgress(runtime, runtime.mode === "json" ? `${JSON.stringify({
 			type: "account.signer",
 			status
 		})}\n` : `Account signer: ${terminalText(status)}\n`)));
@@ -71445,6 +71995,7 @@ const clientFor = (config, store, options) => Effect.gen(function* () {
 	return yield* acquireClient({
 		publishableKey: Redacted.value(config.publishableKey),
 		bootstrapBaseUrl: config.bootstrapBaseUrl,
+		bootstrapCache: bootstrapCache(config, run),
 		requirement: options.requirement ?? "none",
 		accountSetup: "explicit",
 		nodeSessionStorage: {
@@ -71724,15 +72275,48 @@ const lifecycleResult = (lifecycle, email) => ({
 		] : []
 	]
 });
+/**
+* A valuation as currency with its code and two decimals (`3,998.22 USD`), as
+* every amount reads; a currency this CLI cannot format keeps its raw value.
+*/
+const shownValuation = (valuation) => {
+	if (valuation === null) return "unavailable";
+	try {
+		const symbolic = formatMoney(valuation, { grammar: "symbol" });
+		return terminalText(`${symbolic.replace(/^[^\d-]+/u, "")} ${valuation.currency}`);
+	} catch {
+		return `${terminalText(valuation.value)} ${terminalText(valuation.currency)}`;
+	}
+};
+/** Each asset on a row, with the amounts formatted as the home screen formats them. */
+const positionTable = (positions) => {
+	const rows = [[
+		"ASSET",
+		"BALANCE",
+		"AVAILABLE"
+	], ...positions.map((position) => [
+		terminalText(assetName(position.asset)),
+		shownNumber({
+			asset: position.asset,
+			value: position.balance
+		}),
+		shownNumber({
+			asset: position.asset,
+			value: position.available
+		})
+	])];
+	const widths = [
+		0,
+		1,
+		2
+	].map((column) => Math.max(...rows.map((row) => row[column].length)));
+	return rows.map((row) => row.map((cell, column) => column === 0 ? cell.padEnd(widths[0]) : cell.padStart(widths[column])).join("  ").trimEnd());
+};
 const balanceLines$1 = (account) => [
 	`Account ${terminalText(account.id)}`,
-	...account.balances.length === 0 ? ["No asset balances returned."] : account.balances.flatMap((position) => [
-		`  Asset: ${terminalText(position.symbol)} on ${networkName(requireAsset(position.asset).chainId)}`,
-		`  Balance: ${terminalText(position.balance)}`,
-		`  Available: ${terminalText(position.available)}`
-	]),
-	`Balance valuation: ${account.balance === null ? "unavailable" : `${terminalText(account.balance.value)} ${terminalText(account.balance.currency)}`}`,
-	`Available valuation: ${account.available === null ? "unavailable" : `${terminalText(account.available.value)} ${terminalText(account.available.currency)}`}`
+	...account.balances.length === 0 ? ["No asset balances returned."] : positionTable(account.balances),
+	`Balance valuation: ${shownValuation(account.balance)}`,
+	`Available valuation: ${shownValuation(account.available)}`
 ];
 const depositLines = (instructions) => [
 	`Deposit to ${terminalText(instructions.label)}`,
@@ -71780,7 +72364,14 @@ const organizationId = (config, value) => Effect.gen(function* () {
 	});
 	const handle = value.replace(/^@/u, "").toLowerCase();
 	const found = organizations.find((org) => org.handle.toLowerCase() === handle);
-	if (found === void 0) return yield* inputRequired(`You are not a member of an Organization "${terminalText(value)}". See yours with: capxul org list`);
+	if (found === void 0) return yield* inputRequired(`You are not a member of an Organization "${terminalText(value)}". See yours with: capxul org list`, {
+		field: "org",
+		next: [
+			"capxul",
+			"org",
+			"list"
+		]
+	});
 	return found.id;
 });
 /**
@@ -71814,10 +72405,10 @@ const actorScope = (actor) => actor.kind === "personal" ? {
 };
 //#endregion
 //#region src/commands/org/subcommands/shared.ts
-const emailFlag$9 = Flag.String("email").pipe(Flag.optional);
+const emailFlag$9 = Flag.String("email").pipe(Flag.withDescription(FLAG_HELP.email), Flag.optional);
 const scoped$1 = { email: emailFlag$9 };
-const confirmFlag$6 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
-const timeoutFlag$4 = Flag.Int("timeout-seconds").pipe(Flag.withDefault(120));
+const confirmFlag$6 = Flag.Boolean("confirm").pipe(Flag.withDescription(FLAG_HELP.confirm), Flag.withDefault(false));
+const timeoutFlag$4 = Flag.Int("timeout-seconds").pipe(Flag.withDescription(FLAG_HELP.timeout), Flag.withDefault(120));
 const metadata$18 = (name) => ({
 	name,
 	capability: "organization",
@@ -72841,8 +73432,9 @@ const policyLines = (label, policy) => {
 	if (policy.type === "managePeople") return [`${label}: Manage people`];
 	return [
 		`${label}: Budget`,
-		`  Asset ID: ${terminalText(policy.asset)}`,
+		`  Asset: ${terminalText(assetName(policy.asset))}`,
 		`  Per-payment cap: ${policy.limit === null ? "no cap" : terminalText(policy.limit)}`,
+		`  Refill: ${policy.refill === "monthly" ? "Every 30 days" : "None"}`,
 		`  Recipients: ${policy.scope.recipients.type === "anyone" ? "Anyone" : policy.scope.recipients.accounts.map(terminalText).join(", ")}`,
 		`  Actions: ${policy.scope.actions.map((action) => action === "pay" ? "Payments (single and batch)" : "Commitments").join(", ")}`
 	];
@@ -72909,7 +73501,7 @@ const organizationMeLines = (member) => [
 		`  Name: ${terminalText(budget.label)}`,
 		`  Budget ID: ${terminalText(budget.id)}`,
 		`  Per-payment cap: ${budget.limit === null ? "no cap" : terminalText(budget.limit.value)} ${terminalText(budget.asset.symbol)}`,
-		`  Asset ID: ${terminalText(budget.asset.assetId)}`
+		`  Asset: ${terminalText(assetName(budget.asset.assetId))}`
 	])
 ];
 //#endregion
@@ -73090,7 +73682,7 @@ const readOrganization = (config, command, input, handler) => Effect.gen(functio
 	}
 	organizationId = resolved;
 	if (organizationId === null) {
-		if (!interactive || organizations.length === 0) return yield* inputRequired("Provide --org, or choose one with: capxul use org <handle>");
+		if (!interactive || organizations.length === 0) return yield* organizationRequired();
 		organizationId = yield* Prompt.Select({
 			message: "Organization",
 			choices: organizations.map((org) => ({
@@ -73507,10 +74099,10 @@ const command$79 = Command.make("retry", {
 const account = Command.make("account").pipe(annotate$8("root"), Command.withDescription("your Capxul account and its setup"), Command.withSubcommands([command$80, command$79]));
 //#endregion
 //#region src/commands/activity/subcommands/shared.ts
-const emailFlag$8 = Flag.String("email").pipe(Flag.optional);
-const fromFlag = Flag.Int("from").pipe(Flag.optional);
-const toFlag = Flag.Int("to").pipe(Flag.optional);
-const confirmFlag$5 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
+const emailFlag$8 = Flag.String("email").pipe(Flag.withDescription(FLAG_HELP.email), Flag.optional);
+const fromFlag = Flag.Int("from").pipe(Flag.withDescription("only activity from this time on, in epoch milliseconds"), Flag.optional);
+const toFlag = Flag.Int("to").pipe(Flag.withDescription("only activity before this time, in epoch milliseconds"), Flag.optional);
+const confirmFlag$5 = Flag.Boolean("confirm").pipe(Flag.withDescription(FLAG_HELP.confirm), Flag.withDefault(false));
 const names$7 = {
 	root: "activity",
 	list: "activity.list",
@@ -73646,19 +74238,23 @@ const readAnnotation = (source) => Effect.gen(function* () {
 }).pipe(Effect.mapError((error) => source === void 0 || error instanceof CliFailure ? error : annotationError()));
 //#endregion
 //#region src/commands/payment/internal/shared.ts
-/** Money as people read it, with at least two decimals: `550.00 USDC`. */
-const shownAmount = (amount) => {
-	const [number = "", symbol = ""] = formatAssetAmount(amount).split(" ");
-	const [integer = "0", fraction = ""] = number.split(".");
-	return `${integer}.${fraction.padEnd(2, "0")} ${symbol}`;
-};
 const paymentIdPattern = /^payment_[0-9A-Za-z]+$/u;
-const readPaymentId = (paymentId) => paymentIdPattern.test(paymentId) ? Effect.succeed(paymentId) : Effect.fail(new CliFailure({
-	code: "CLI_USAGE",
-	message: "Provide the Payment ID: payment_ followed by letters or digits.",
-	exitCode: 2,
-	outcome: "refused"
-}));
+const readPaymentId = (paymentId) => paymentIdPattern.test(paymentId) ? Effect.succeed(paymentId) : Effect.gen(function* () {
+	const runtime = yield* CliRuntime;
+	return yield* new CliFailure({
+		code: "CLI_USAGE",
+		message: "Provide the Payment ID: payment_ followed by letters or digits.",
+		field: "id",
+		next: [
+			"capxul",
+			"payment",
+			"list",
+			...scopeArgs(runtime.args ?? [])
+		],
+		exitCode: 2,
+		outcome: "refused"
+	});
+});
 const paymentLines = (payment) => [
 	`Payment ${terminalText(payment.id)}`,
 	`  Status: ${payment.status}`,
@@ -73680,8 +74276,8 @@ const incomplete = (warning) => warning === void 0 ? [] : ["Activity is incomple
 const pageLines = (page) => [
 	...incomplete(page.readWarning),
 	`Activity: ${page.items.length} rows`,
-	...page.items.map((item) => `${item.kind === "movement" ? "Movement" : "Payment"} ${terminalText(item.id)}: ${terminalText(item.amount.value)} ${terminalText(item.amount.asset)}`),
-	page.nextCursor === null ? "End of activity." : `More: the same command with --after ${terminalText(page.nextCursor)}`,
+	...page.items.map((item) => `${item.kind === "movement" ? "Movement" : "Payment"} ${terminalText(item.id)}: ${terminalText(item.amount.value)} ${terminalText(assetName(item.amount.asset))}`),
+	page.nextCursor === null ? "End of activity." : `More: the same command with --after ${terminalText(shellArgument(page.nextCursor))}`,
 	`Checkpoint: ${page.checkpoint}`,
 	`Observed at: ${page.observedAt}`
 ];
@@ -73690,7 +74286,11 @@ const summaryLines = (summary, window) => [
 	`From: ${window?.from === void 0 ? "unbounded" : window.from}`,
 	`To: ${window?.to === void 0 ? "unbounded" : window.to}`,
 	`Activity: ${summary.count} rows`,
-	...summary.totals.map((total) => `${terminalText(total.asset)}: in ${terminalText(total.in)}, out ${terminalText(total.out)}, net ${terminalText(total.net)}, pending in ${terminalText(total.pendingIn)} raw units`),
+	...summary.totals.map((total) => {
+		const known = shownBaseUnits(total.asset, "0") !== void 0;
+		const show = (raw) => terminalText(shownBaseUnits(total.asset, raw) ?? raw);
+		return `${terminalText(assetName(total.asset))}: in ${show(total.in)}, out ${show(total.out)}, net ${show(total.net)}, pending in ${show(total.pendingIn)}${known ? "" : " raw units"}`;
+	}),
 	`Observed at: ${summary.observedAt}`
 ];
 const detailLines = (activity, id) => [
@@ -73726,11 +74326,11 @@ const execute$90 = (config, input) => Effect.gen(function* () {
 //#region src/commands/activity/subcommands/list/command.ts
 const command$78 = Command.make("list", {
 	email: emailFlag$8,
-	limit: Flag.Int("limit").pipe(Flag.withDefault(25)),
+	limit: Flag.Int("limit").pipe(Flag.withDescription("how many rows to return, 1 to 100"), Flag.withDefault(25)),
 	cursor: Flag.String("after").pipe(Flag.withDescription("the next page's cursor"), Flag.optional),
-	activityKind: Flag.String("kind").pipe(Flag.optional),
-	direction: Flag.String("direction").pipe(Flag.optional),
-	statuses: Flag.String("status").pipe(Flag.atLeast(0)),
+	activityKind: Flag.String("kind").pipe(Flag.withDescription("only payments or only movements"), Flag.optional),
+	direction: Flag.String("direction").pipe(Flag.withDescription("only in, out or self"), Flag.optional),
+	statuses: Flag.String("status").pipe(Flag.withDescription("only payments in this status; repeat it for several"), Flag.atLeast(0)),
 	from: fromFlag,
 	to: toFlag
 }, ({ email, limit, cursor, activityKind, direction, statuses, from, to }) => dispatch$7("list", (config, orgId) => execute$90(config, {
@@ -73854,48 +74454,17 @@ const saveDocumentPdf = (config, document, outputDirectory) => Effect.gen(functi
 		byteLength: rendered.bytes.byteLength
 	};
 });
-/** Document output cannot change a Payment result or start another Payment. */
-const savePaymentDocuments = (config, client, payment, outputDirectory) => Effect.gen(function* () {
-	const refs = [...new Map(payment.documents.map((ref) => [`${ref.documentHash}:${ref.contentHash}`, ref])).values()];
-	const outputs = yield* Effect.forEach(refs, (ref) => Effect.gen(function* () {
-		const document = yield* Effect.tryPromise({
-			try: (signal) => client.paymentDocuments.render({
-				documentHash: ref.documentHash,
-				contentHash: ref.contentHash
-			}, { signal }),
-			catch: () => failure("CLI_DEFECT", "The payment document could not be read.")
-		}).pipe(Effect.flatMap(resultValue));
-		if (document.documentHash.toLowerCase() !== ref.documentHash.toLowerCase() || document.contentHash.toLowerCase() !== ref.contentHash.toLowerCase()) return yield* failure("CLI_DEFECT", "The payment document hashes do not match.");
-		return {
-			state: "saved",
-			...yield* saveDocumentPdf(config, document, outputDirectory)
-		};
-	}).pipe(Effect.catch((error) => {
-		const classified = classifyFailure(Cause.fail(error));
-		return Effect.succeed({
-			state: "failed",
-			documentHash: ref.documentHash,
-			contentHash: ref.contentHash,
-			error: {
-				code: classified.code,
-				message: classified.message
-			}
-		});
-	})));
-	return {
-		state: outputs.some((output) => output.state === "failed") ? "failed" : payment.documentState === "unavailable" ? "unavailable" : payment.documentState === "pending" || refs.length === 0 ? "pending" : "ready",
-		outputs
-	};
-});
-const documentOutputLines = (output) => [`  Document output: ${output.state}`, ...output.outputs.map((document) => document.state === "saved" ? `  PDF: ${terminalText(document.path)}` : `  Document ${terminalText(document.documentHash)}: ${terminalText(document.error.message)}`)];
 /** The command that saves one document as PDF. Reads never write files themselves. */
 const renderCommand = (ref) => `capxul document render --document-hash ${ref.documentHash} --content-hash ${ref.contentHash}`;
+const uniqueRefs = (payment) => [...new Map(payment.documents.map((ref) => [`${ref.documentHash}:${ref.contentHash}`, ref])).values()];
 /** A read's documents: where they stand, and the command that saves each one as PDF. */
 const documentReferenceLines = (payment) => {
-	const refs = [...new Map(payment.documents.map((ref) => [`${ref.documentHash}:${ref.contentHash}`, ref])).values()];
+	const refs = uniqueRefs(payment);
 	if (refs.length === 0) return payment.documentState === "pending" ? ["  Documents: being prepared"] : [];
 	return refs.map((ref) => `  ${ref.kind}: ${terminalText(renderCommand(ref))}`);
 };
+/** A write saves no file: this names the command that saves each document as PDF. */
+const saveDocumentLines = (payment) => uniqueRefs(payment).map((ref) => `Save the ${ref.kind}: ${terminalText(renderCommand(ref))}`);
 //#endregion
 //#region src/commands/activity/subcommands/get/execute.ts
 const execute$89 = (config, input) => Effect.gen(function* () {
@@ -73920,8 +74489,8 @@ const execute$89 = (config, input) => Effect.gen(function* () {
 //#region src/commands/activity/subcommands/get/command.ts
 const command$77 = Command.make("get", {
 	email: emailFlag$8,
-	activityKind: Flag.String("kind"),
-	id: Flag.String("id")
+	activityKind: Flag.String("kind").pipe(Flag.withDescription("payment or movement")),
+	id: Flag.String("id").pipe(Flag.withDescription("the Payment or movement ID"))
 }, ({ email, activityKind, id }) => dispatch$7("get", (config, orgId) => execute$89(config, {
 	kind: "get",
 	email: Option.getOrUndefined(email),
@@ -73984,7 +74553,7 @@ const execute$87 = (config, input) => Effect.gen(function* () {
 //#region src/commands/activity/subcommands/annotate/command.ts
 const command$75 = Command.make("annotate", {
 	email: emailFlag$8,
-	source: Flag.String("input").pipe(Flag.optional),
+	source: Flag.String("input").pipe(Flag.withDescription("the annotation JSON, from a file or - for stdin"), Flag.optional),
 	confirm: confirmFlag$5
 }, ({ email, source, confirm }) => dispatch$7("annotate", (config, orgId) => execute$87(config, {
 	kind: "annotate",
@@ -74044,7 +74613,7 @@ const metadata$16 = {
 	capability: "account",
 	observation: "command"
 };
-const address = Command.make("address", { email: Flag.String("email").pipe(Flag.optional) }, ({ email }) => runCommand({
+const address = Command.make("address", { email: Flag.String("email").pipe(Flag.withDescription(FLAG_HELP.email), Flag.optional) }, ({ email }) => runCommand({
 	...metadata$16,
 	network: true
 }, (config) => execute$84(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$16), Command.withDescription("where to send crypto to this account"), Command.withExamples([{ command: "capxul address" }]));
@@ -74125,11 +74694,14 @@ const command$74 = Command.make("login", {
 */
 const execute$82 = (config, input) => Effect.gen(function* () {
 	const pending = (yield* readWhere(config)).origins?.[config.bootstrapBaseUrl]?.pending;
-	if (input.email === void 0 && pending === void 0) return yield* inputRequired("No sign-in is waiting for a code. Start one with: capxul auth login");
+	if (input.email === void 0 && pending === void 0) return yield* inputRequired("No sign-in is waiting for a code. Start one with: capxul auth login", { next: SIGN_IN$1 });
 	const email = yield* readEmail(input.email ?? pending);
 	const store = yield* openSessionRecord(config, email);
 	const flow = store.current().flow;
-	if (flow === null || flow.email !== email) return yield* inputRequired("No sign-in is waiting for a code for that email. Start one with: capxul auth login");
+	if (flow === null || flow.email !== email) return yield* inputRequired("No sign-in is waiting for a code for that email. Start one with: capxul auth login", {
+		field: "email",
+		next: SIGN_IN$1
+	});
 	const client = yield* clientFor(config, store, { restore: false });
 	yield* call((signal) => client.auth.getSession({ signal }));
 	yield* call((signal) => client.auth.resumeOtp({
@@ -74349,7 +74921,7 @@ const metadata$14 = {
 	capability: "account",
 	observation: "command"
 };
-const balance = Command.make("balance", { email: Flag.String("email").pipe(Flag.optional) }, ({ email }) => runCommand({
+const balance = Command.make("balance", { email: Flag.String("email").pipe(Flag.withDescription(FLAG_HELP.email), Flag.optional) }, ({ email }) => runCommand({
 	...metadata$14,
 	network: true
 }, (config) => execute$77(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$14), Command.withDescription("balances for whoever you're acting as"), Command.withExamples([{ command: "capxul balance" }, {
@@ -74415,12 +74987,12 @@ const config = Command.make("config").pipe(Command.annotate(CliCommandMetadata,
 }), Command.withDescription("this CLI's own settings"), Command.withSubcommands([telemetry]));
 //#endregion
 //#region src/commands/contact/subcommands/shared.ts
-const emailFlag$6 = Flag.String("email").pipe(Flag.optional);
-const includeHiddenFlag = Flag.Boolean("include-hidden").pipe(Flag.withDefault(false));
+const emailFlag$6 = Flag.String("email").pipe(Flag.withDescription(FLAG_HELP.email), Flag.optional);
+const includeHiddenFlag = Flag.Boolean("include-hidden").pipe(Flag.withDescription("also list the contacts you hid"), Flag.withDefault(false));
 const entryIdArgument = Argument.String("id").pipe(Argument.withDescription("The contact's PartyId"), Argument.optional);
-const labelFlag = Flag.String("label");
-const inputFlag = Flag.String("input").pipe(Flag.optional);
-const confirmFlag$4 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
+const labelFlag = Flag.String("label").pipe(Flag.withDescription("the new label to show for this contact"));
+const inputFlag = Flag.String("input").pipe(Flag.withDescription("the contact JSON, from a file or - for stdin"), Flag.optional);
+const confirmFlag$4 = Flag.Boolean("confirm").pipe(Flag.withDescription(FLAG_HELP.confirm), Flag.withDefault(false));
 const names$6 = {
 	root: "contact",
 	list: "contact.list",
@@ -74635,7 +75207,15 @@ const selectContactParty = (book, supplied, orgs) => Effect.gen(function* () {
 const optionalPartyId = (value) => Effect.gen(function* () {
 	if (value !== void 0) return yield* partyId(value);
 	const runtime = yield* CliRuntime;
-	if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* inputRequired("Provide the contact ID.");
+	if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* inputRequired("Provide the contact ID.", {
+		field: "id",
+		next: [
+			"capxul",
+			"contact",
+			"list",
+			...scopeArgs(runtime.args ?? [])
+		]
+	});
 	return null;
 });
 const actorLine = (orgs) => orgs[0] === void 0 ? "Actor: personal" : `Actor: Organization ${JSON.stringify(orgs[0])}`;
@@ -74918,26 +75498,41 @@ const readRecipient$1 = (value) => Effect.gen(function* () {
 		kind: "email",
 		email: yield* readEmail(text)
 	} };
-	return yield* Effect.try({
+	if (!/^0x[0-9a-f]*$/iu.test(text)) return yield* Effect.try({
 		try: () => ({ to: {
 			kind: "handle",
 			handle: String(toHandle(text.replace(/^@/u, "")))
 		} }),
-		catch: () => inputRequired(`Send to an email, a @handle, or an 0x address, not "${terminalText(text)}".`)
+		catch: () => notARecipient(text)
 	});
+	return yield* notARecipient(text);
 });
+/**
+* The backend refuses a handle nobody has with only the field and a reason, so
+* the sentence that names the recipient is written here, where it is known.
+*/
+const namingRecipient = (to) => (error) => to.kind === "handle" && error.code === "INVALID_INPUT" && error.details?.field === "handle" ? new CliFailure({
+	...classifyFailure(Cause.fail(error)),
+	message: `No one has the handle @${terminalText(to.handle)}. Send to an email, an existing @handle or an 0x address.`
+}) : error;
+/** What a recipient can be, naming the one that was typed. */
+const notARecipient = (text) => inputRequired(`"${terminalText(text)}" is not a valid email, @handle or 0x address.`, { field: "to" });
 /** `<amount>` of `--asset` (a symbol the account holds, or an asset ID). */
 const readAmount = (value, asset, account) => Effect.gen(function* () {
 	const wanted = asset.trim().toUpperCase();
 	const position = account.balances.find((held) => held.symbol.toUpperCase() === wanted || held.asset.toUpperCase() === wanted);
 	if (position === void 0) return yield* inputRequired(`Your account holds no ${terminalText(asset)}. Choose one it holds with --asset: ${account.balances.map((held) => held.symbol).join(", ")}.`);
-	const amount = parseAssetAmount(value.trim(), requireAsset(position.asset));
-	if (isMoneyParseError(amount) || /^0*(?:\.0*)?$/u.test(amount.value)) return yield* inputRequired("Provide a positive amount, like 50 or 12.5.");
+	const metadata = requireAsset(position.asset);
+	const amount = parseAssetAmount(value.trim(), metadata);
+	if (isMoneyParseError(amount)) return yield* inputRequired(amountRefusal(amount.reason, metadata), { field: "amount" });
+	if (/^0*(?:\.0*)?$/u.test(amount.value)) return yield* inputRequired(amountRefusal("non-positive", metadata), { field: "amount" });
 	return {
 		amount,
 		position
 	};
 });
+/** Why an amount was refused, as a sentence that names the cause. */
+const amountRefusal = (reason, asset) => reason === "too-many-decimals" ? `${asset.symbol} has ${asset.decimals} decimals: use at most ${asset.decimals} decimal places.` : "Provide a positive amount, like 50 or 12.5.";
 /** The recipient and amount, asked on a terminal when the command line has none. */
 const readSendWords = (to, amount) => Effect.gen(function* () {
 	if (to !== void 0 && amount !== void 0) return {
@@ -75079,7 +75674,7 @@ const keyCommand = Command.make("key", {
 const fundCommand = Command.make("fund", {
 	amount: Argument.String("amount").pipe(Argument.withDescription("how much test money, like 100"), Argument.withDefault("100")),
 	asset: Flag.String("asset").pipe(Flag.withDescription("which test asset: a symbol your account holds"), Flag.withDefault("USDC")),
-	email: Flag.String("email").pipe(Flag.optional)
+	email: Flag.String("email").pipe(Flag.withDescription(FLAG_HELP.email), Flag.optional)
 }, ({ amount, asset, email }) => runCommand({
 	...metadata$11("dev.fund"),
 	network: true
@@ -75213,16 +75808,13 @@ const balanceLines = (positions) => {
 	if (positions === null) return ["Balances", "  unavailable right now"];
 	const held = positions.filter((position) => !/^0*(?:\.0*)?$/u.test(position.balance));
 	if (held.length === 0) return ["Balances", "  nothing yet"];
-	const amounts = held.map((position) => {
-		const shown = shownAmount({
+	const amounts = held.map((position) => ({
+		symbol: position.symbol,
+		value: shownNumber({
 			asset: position.asset,
 			value: position.balance
-		});
-		return {
-			symbol: position.symbol,
-			value: shown.slice(0, shown.lastIndexOf(" "))
-		};
-	});
+		})
+	}));
 	const symbolWidth = Math.max(...amounts.map((entry) => entry.symbol.length));
 	const valueWidth = Math.max(...amounts.map((entry) => entry.value.length));
 	return ["Balances", ...amounts.map((entry) => `  ${terminalText(entry.symbol).padEnd(symbolWidth)}   ${entry.value.padStart(valueWidth)}`)];
@@ -75298,7 +75890,7 @@ const readEach = (client, orgId, scope) => {
 		needs: inbox === null || paid === null ? null : needsFrom({
 			requestsToPay: inbox.items.filter((item) => item.status === "open").map((item) => item.id),
 			payrollToApprove: (payroll?.items ?? []).filter((run) => run.status === "draft").map((run) => run.id),
-			paymentsToRetry: paid.items.filter((payment) => payment.execution?.retryRequired === true).map((payment) => payment.id)
+			paymentsToRetry: paid.items.filter((payment) => payment.execution?.retryRequired === true && payment.direction !== "in").map((payment) => payment.id)
 		}, scope)
 	})));
 };
@@ -75332,7 +75924,10 @@ const execute$64 = (config) => Effect.gen(function* () {
 	if (client === null) return notSignedIn;
 	const named = flagValue(runtime.args ?? [], "org");
 	const scope = named === void 0 ? [] : ["--org", named];
-	const { balances, needs } = yield* readHome(client, actor.kind === "personal" ? null : actor.id, scope);
+	const { balances, needs } = yield* withWaiting(readHome(client, actor.kind === "personal" ? null : actor.id, scope), {
+		...runtime,
+		label: "Loading balances and what needs you"
+	});
 	const tryArgv = [
 		[
 			"capxul",
@@ -75386,10 +75981,10 @@ const home = Command.make("home", {}, () => runCommand({
 }, execute$64)).pipe(Command.annotate(CliCommandMetadata, metadata$9), Command.withDescription("home screen: where you are, what needs you"), Command.unlisted);
 //#endregion
 //#region src/commands/document/subcommands/shared.ts
-const documentHashFlag = Flag.String("document-hash");
-const contentHashFlag = Flag.String("content-hash");
-const emailFlag$5 = Flag.String("email").pipe(Flag.optional);
-const outFlag = Flag.String("out");
+const documentHashFlag = Flag.String("document-hash").pipe(Flag.withDescription("the document's hash"));
+const contentHashFlag = Flag.String("content-hash").pipe(Flag.withDescription("the hash of its content"));
+const emailFlag$5 = Flag.String("email").pipe(Flag.withDescription(FLAG_HELP.email), Flag.optional);
+const outFlag = Flag.String("out").pipe(Flag.withDescription("the new file to write the original bytes to"));
 const names$5 = {
 	root: "document",
 	get: "document.get",
@@ -75508,7 +76103,7 @@ const command$59 = Command.make("render", {
 	documentHash: documentHashFlag,
 	contentHash: contentHashFlag,
 	email: emailFlag$5,
-	outputDirectory: Flag.String("output-dir").pipe(Flag.optional)
+	outputDirectory: Flag.String("output-dir").pipe(Flag.withDescription("where to save the PDF and HTML (default: the documents folder next to CLI settings)"), Flag.optional)
 }, ({ documentHash, contentHash, email, outputDirectory }) => dispatch$4("render", (config) => execute$61(config, {
 	kind: "render",
 	documentHash,
@@ -75946,8 +76541,9 @@ const invitationGrantLines = (grant) => {
 	return [
 		`  ${grant.type === "new_budget" ? "New Budget" : "Budget"}: ${terminalText(grant.label)}`,
 		...grant.type === "budget" ? [`    Budget ID: ${terminalText(grant.budgetId)}`] : [],
-		`    Asset: ${terminalText(grant.policy.asset)}`,
-		`    Per-payment cap: ${grant.policy.limit === null ? "no cap" : terminalText(grant.policy.limit)}`,
+		`    Asset: ${terminalText(assetName(grant.policy.asset))}`,
+		`    Per-payment cap: ${grant.policy.limit === null ? "no cap" : `${terminalText(grant.policy.limit)} ${terminalText(assetName(grant.policy.asset))}`}`,
+		`    Refill: ${grant.policy.refill === "monthly" ? "Every 30 days" : "None"}`,
 		`    Recipients: ${grant.policy.scope.recipients.type === "anyone" ? "anyone" : grant.policy.scope.recipients.accounts.map(terminalText).join(", ")}`,
 		`    Actions: ${grant.policy.scope.actions.join(", ")}`
 	];
@@ -76089,10 +76685,10 @@ const previewLines$1 = (preview, recipient) => [
 ];
 //#endregion
 //#region src/commands/org-invite/subcommands/shared.ts
-const emailFlag$4 = Flag.String("email").pipe(Flag.optional);
+const emailFlag$4 = Flag.String("email").pipe(Flag.withDescription(FLAG_HELP.email), Flag.optional);
 const invitationIdArgument = Argument.String("id").pipe(Argument.withDescription("The invitation ID"), Argument.optional);
-const timeoutFlag$3 = Flag.Int("timeout-seconds").pipe(Flag.withDefault(120));
-const confirmFlag$3 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
+const timeoutFlag$3 = Flag.Int("timeout-seconds").pipe(Flag.withDescription(FLAG_HELP.timeout), Flag.withDefault(120));
+const confirmFlag$3 = Flag.Boolean("confirm").pipe(Flag.withDescription(FLAG_HELP.confirm), Flag.withDefault(false));
 const target = {
 	invitationId: invitationIdArgument,
 	email: emailFlag$4
@@ -76129,8 +76725,8 @@ const command$57 = Command.make("invite", {
 	permissionIds: Flag.String("permission-id").pipe(Flag.withDescription("Manage-people Permission ID"), Flag.atLeast(0)),
 	...newBudgetFlags,
 	email: emailFlag$4,
-	requestKey: Flag.String("request-key").pipe(Flag.optional),
-	preview: Flag.Boolean("preview").pipe(Flag.withDefault(false)),
+	requestKey: Flag.String("request-key").pipe(Flag.withDescription("a key that makes repeating the same invitation safe"), Flag.optional),
+	preview: Flag.Boolean("preview").pipe(Flag.withDescription("show what would be authorized and write nothing"), Flag.withDefault(false)),
 	confirm: confirmFlag$3,
 	timeoutSeconds: timeoutFlag$3
 }, ({ email, toEmail, accountId, budgetIds, permissionIds, newBudgetName, asset, limit, unlimited, recipientAccounts, anyRecipient, actions, requestKey, preview, confirm, timeoutSeconds }) => Effect.gen(function* () {
@@ -76396,8 +76992,8 @@ const execute$58 = (config, input) => Effect.gen(function* () {
 /** --expected-offer is a compatibility spelling; conflicting digests refuse. */
 const command$56 = Command.make("accept", {
 	...target,
-	offerDigest: Flag.String("offer-digest").pipe(Flag.optional),
-	expectedOffer: Flag.String("expected-offer").pipe(Flag.optional),
+	offerDigest: Flag.String("offer-digest").pipe(Flag.withDescription("the digest of the offer you reviewed; scripts must pass it"), Flag.optional),
+	expectedOffer: Flag.String("expected-offer").pipe(Flag.withDescription("the same as --offer-digest, under its older name"), Flag.optional),
 	confirm: confirmFlag$3,
 	timeoutSeconds: timeoutFlag$3
 }, ({ email, invitationId, offerDigest, expectedOffer, confirm, timeoutSeconds }) => dispatch$3("invite.accept", "own", (config, orgs) => execute$58(config, {
@@ -76527,9 +77123,9 @@ const make$1 = (side) => {
 	const name = side === "own" ? "invite.list" : "org.invite.list";
 	return Command.make("list", {
 		email: emailFlag$4,
-		limit: Flag.Int("limit").pipe(Flag.optional),
+		limit: Flag.Int("limit").pipe(Flag.withDescription("how many invitations to return"), Flag.optional),
 		cursor: Flag.String("after").pipe(Flag.withDescription("the next page's cursor"), Flag.optional),
-		phases: Flag.String("phase").pipe(Flag.atLeast(0))
+		phases: Flag.String("phase").pipe(Flag.withDescription("only invitations in this phase; repeat it for several"), Flag.atLeast(0))
 	}, ({ email, limit, cursor, phases }) => dispatch$3(name, side, (config, orgs) => side === "org" && orgs.length === 0 ? Effect.fail(inputRequired("Provide --org.")) : execute$54(config, {
 		email: Option.getOrUndefined(email),
 		orgs,
@@ -76623,7 +77219,7 @@ const execute$50 = (config, input) => Effect.gen(function* () {
 			const key = JSON.stringify(progress);
 			if (key === previous) return;
 			previous = key;
-			await run(writeStderr(runtime.mode === "json" ? `${key}\n` : `Invitation ${terminalText(invitation.id)}: ${terminalText(invitation.phase)}; delivery: ${terminalText(invitation.delivery)}${invitation.recovery === null ? "" : `; recovery: ${terminalText(invitation.recovery.action)} (${terminalText(invitation.recovery.reason)})`}\n`), { signal });
+			await run(writeProgress(runtime, runtime.mode === "json" ? `${key}\n` : `Invitation ${terminalText(invitation.id)}: ${terminalText(invitation.phase)}; delivery: ${terminalText(invitation.delivery)}${invitation.recovery === null ? "" : `; recovery: ${terminalText(invitation.recovery.action)} (${terminalText(invitation.recovery.reason)})`}\n`), { signal });
 		});
 	}).pipe(Effect.onInterrupt(() => writeInvitationReadRecovery(runtime.mode, resolvedOrg, invitationId, session.email).pipe(Effect.ignoreCause))), {
 		...runtime,
@@ -76675,7 +77271,7 @@ const organizationInvite = Command.make("invite").pipe(annotate$3(CAPXUL_OPERATI
 //#endregion
 //#region src/commands/offer/subcommands/shared.ts
 const idArgument$1 = Argument.String("id").pipe(Argument.withDescription("The offer ID"));
-const revisionFlag = Flag.Int("expected-revision");
+const revisionFlag = Flag.Int("expected-revision").pipe(Flag.withDescription("the revision you last read, so a change made since is not overwritten"));
 const names$4 = {
 	root: "offer",
 	list: "offer.list",
@@ -76699,9 +77295,9 @@ const makeContext$1 = () => ({
 });
 //#endregion
 //#region src/commands/request/subcommands/shared.ts
-const emailFlag$3 = Flag.String("email").pipe(Flag.optional);
+const emailFlag$3 = Flag.String("email").pipe(Flag.withDescription(FLAG_HELP.email), Flag.optional);
 const idArgument = Argument.String("id").pipe(Argument.withDescription("The request ID"));
-const confirmFlag$2 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
+const confirmFlag$2 = Flag.Boolean("confirm").pipe(Flag.withDescription(FLAG_HELP.confirm), Flag.withDefault(false));
 const names$3 = {
 	"issued.root": "request",
 	"issued.issue": "request.issue",
@@ -76920,8 +77516,8 @@ const execute$47 = (config, input) => Effect.gen(function* () {
 //#region src/commands/offer/subcommands/create/command.ts
 const command$45 = (context) => Command.make("create", {
 	email: emailFlag$3,
-	source: Flag.String("input"),
-	requestKey: Flag.String("request-key"),
+	source: Flag.String("input").pipe(Flag.withDescription("the offer JSON, from a file or - for stdin")),
+	requestKey: Flag.String("request-key").pipe(Flag.withDescription("a key that makes repeating the same create safe")),
 	confirm: confirmFlag$2
 }, ({ email, source, requestKey, confirm }) => context.dispatch("create", (scope) => ({
 	kind: "create",
@@ -76960,7 +77556,7 @@ const command$44 = (context) => Command.make("revise", {
 	email: emailFlag$3,
 	id: idArgument$1,
 	revision: revisionFlag,
-	source: Flag.String("input"),
+	source: Flag.String("input").pipe(Flag.withDescription("the offer JSON, from a file or - for stdin")),
 	confirm: confirmFlag$2
 }, ({ email, id, revision, source, confirm }) => context.dispatch("revise", (scope) => ({
 	kind: "revise",
@@ -77022,15 +77618,16 @@ const makeCommand = () => {
 const offer = makeCommand();
 //#endregion
 //#region src/commands/org/subcommands/permission/subcommands/shared.ts
-const emailFlag$2 = Flag.String("email").pipe(Flag.optional);
+const emailFlag$2 = Flag.String("email").pipe(Flag.withDescription(FLAG_HELP.email), Flag.optional);
 const permissionIdArgument = Argument.String("id").pipe(Argument.withDescription("The Permission ID"));
-const sourceFlag$2 = Flag.String("input").pipe(Flag.optional);
-const accountIdFlag = Flag.String("account-id").pipe(Flag.optional);
+const sourceFlag$2 = Flag.String("input").pipe(Flag.withDescription("the Permission JSON, from a file or - for stdin"), Flag.optional);
+const accountIdFlag = Flag.String("account-id").pipe(Flag.withDescription("the member's Account ID"), Flag.optional);
 const assignmentIdArgument = Argument.String("id").pipe(Argument.withDescription("The Permission assignment ID"), Argument.optional);
-const expectedMemberEmailFlag = Flag.String("expected-member-email").pipe(Flag.optional);
-const requestKeyFlag$2 = Flag.String("request-key").pipe(Flag.between(0, 1), Flag.map((values) => Option.fromUndefinedOr(values[0])));
-const confirmFlag$1 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
-const timeoutFlag$2 = Flag.Int("timeout-seconds").pipe(Flag.withDefault(120));
+const expectedMemberEmailFlag = Flag.String("expected-member-email").pipe(Flag.withDescription("the member's email, checked before anything changes"), Flag.optional);
+const requestKeyFlag$2 = Flag.String("request-key").pipe(Flag.withDescription(FLAG_HELP.requestKey), Flag.between(0, 1), Flag.map((values) => Option.fromUndefinedOr(values[0])));
+const confirmFlag$1 = Flag.Boolean("confirm").pipe(Flag.withDescription(FLAG_HELP.confirm), Flag.withDefault(false));
+const waitFlag = Flag.Boolean("wait").pipe(Flag.withDescription("after submitting, follow the Permission command until it is applied, failed or needs action"), Flag.withDefault(false));
+const timeoutFlag$2 = Flag.Int("timeout-seconds").pipe(Flag.withDescription(FLAG_HELP.timeout), Flag.withDefault(120));
 const names$2 = {
 	root: "org.permission",
 	list: "org.permission.list",
@@ -77057,7 +77654,7 @@ const dispatch$2 = (kind, execute) => runCommand({
 //#endregion
 //#region src/commands/org/subcommands/permission/internal/write-input.ts
 const LIMIT$2 = 65536;
-const invalid$5 = () => inputRequired("Provide a complete Permission policy with an exact asset, positive cap, recipient rule, and supported actions.");
+const invalid$5 = () => inputRequired("Provide a complete Permission policy with an exact asset, positive cap, recipient rule, supported actions, and an optional refill (\"monthly\": every 30 days, or \"none\").");
 /** File, stdin, and guided answers use the SDK's complete-policy decoder. */
 const parsePermissionInput = (input) => Effect.try({
 	try: () => decodePermissionIntent(input),
@@ -77101,6 +77698,18 @@ const guidePermissionInput = (before) => Effect.gen(function* () {
 		message: existing === null ? "Per-payment cap (major units)" : `Per-payment cap (major units; asset fixed: ${asset})`,
 		...existing?.limit == null ? {} : { default: existing.limit }
 	});
+	const refill = yield* Prompt.Select({
+		message: "Refill",
+		choices: [{
+			title: "Refills every 30 days",
+			value: "monthly",
+			selected: existing === null || existing.refill === "monthly"
+		}, {
+			title: "Never refills (the cap is one pot)",
+			value: "none",
+			selected: existing !== null && existing.refill !== "monthly"
+		}]
+	});
 	const recipients = yield* Prompt.Select({
 		message: "Recipient rule",
 		choices: [{
@@ -77128,6 +77737,7 @@ const guidePermissionInput = (before) => Effect.gen(function* () {
 			asset,
 			value
 		},
+		refill,
 		scope: {
 			recipients: recipients === "anyone" ? { type: "anyone" } : {
 				type: "allowlist",
@@ -77312,7 +77922,7 @@ const validateWriteInput = (input) => Effect.gen(function* () {
 const selectPolicy = (input, read, orgId, suppliedId, suppliedIntent, interactive) => Effect.gen(function* () {
 	const permission = input.kind === "change" ? yield* selectPermission(read?.items ?? [], orgId, suppliedId, interactive) : null;
 	const before = permission?.currentPolicy ?? null;
-	const intent = suppliedIntent ?? (yield* guidePermissionInput(before));
+	const intent = keepRefillOnChange(suppliedIntent ?? (yield* guidePermissionInput(before)), before);
 	if (before?.type === "budget" && intent.type === "budget" && before.asset !== intent.asset) return yield* inputRequired("A Budget change must retain its exact asset.");
 	const after = intentPolicy(intent);
 	const reset = allowanceReset(before, after);
@@ -77346,7 +77956,7 @@ const samePolicy = (left, right) => {
 	if (left === null || right === null) return left === right;
 	if (left.type !== right.type) return false;
 	if (left.type === "managePeople" || right.type === "managePeople") return true;
-	return left.asset === right.asset && cap$1(left.limit) === cap$1(right.limit) && recipients(left) === recipients(right) && [...left.scope.actions].sort().join(",") === [...right.scope.actions].sort().join(",");
+	return left.asset === right.asset && cap$1(left.limit) === cap$1(right.limit) && left.refill === "monthly" === (right.refill === "monthly") && recipients(left) === recipients(right) && [...left.scope.actions].sort().join(",") === [...right.scope.actions].sort().join(",");
 };
 const allowanceReset = (before, after) => before?.type === "budget" && before.limit !== null || before !== null && after.type === "budget" && after.limit !== null;
 const writeFailureMessage = (error, fallback) => {
@@ -77372,14 +77982,14 @@ const selectionPreview = (selection) => {
 		} : { assignmentId: selection.assignmentId }
 	};
 };
+/** The first line after a write is submitted. Submission does not prove application. */
+const submittedLine = (kind) => kind === "assign" ? "Submitted. Assignment is pending application." : kind === "revoke" ? "Submitted. Assignment removal is pending application." : kind === "replace" ? "Submitted. Module replacement is pending application." : "Submitted. The Permission is pending application.";
 //#endregion
 //#region src/commands/org/subcommands/permission/internal/presentation.ts
 const cap = (permission) => {
 	if (permission.limitRaw === void 0) return "no cap";
 	if (permission.decimals === void 0) return `${terminalText(permission.limitRaw)} raw units (decimals unavailable)`;
-	const decimals = permission.decimals;
-	const raw = String(permission.limitRaw).padStart(decimals + 1, "0");
-	return decimals === 0 ? raw : `${raw.slice(0, -decimals)}.${raw.slice(-decimals)}`;
+	return fromBaseUnits(String(permission.limitRaw), { decimals: permission.decimals });
 };
 const permissionLines = (permission) => [
 	`Permission ${terminalText(permission.permissionId)}`,
@@ -77387,7 +77997,7 @@ const permissionLines = (permission) => [
 	`  Type: ${permission.type === "budget" ? "Budget" : "Manage people"}`,
 	`  State: ${permission.state}`,
 	`  Revision: ${permission.revision}`,
-	...permission.type === "budget" ? [`  Asset ID: ${permission.assetId === void 0 ? "unavailable" : terminalText(permission.assetId)}`, `  Per-payment cap: ${cap(permission)}`] : [],
+	...permission.type === "budget" ? [`  Asset: ${permission.assetId === void 0 ? "unavailable" : terminalText(assetName(permission.assetId))}`, `  Per-payment cap: ${cap(permission)}`] : [],
 	...permission.currentPolicy === void 0 ? [] : policyLines("  Current policy", permission.currentPolicy)
 ];
 const permissionListLines = (organizationId, result, name) => [
@@ -77429,7 +78039,7 @@ const resolvePermissionScope = (config, email, explicit) => Effect.gen(function*
 	});
 	let orgId = explicit ?? (yield* readOrganizationSelection(config, session.authUserId));
 	if (orgId === null) {
-		if (!runtime.tty || runtime.ci || runtime.mode === "json" || organizations.length === 0) return yield* inputRequired("Provide --org, or choose one with: capxul use org <handle>");
+		if (!runtime.tty || runtime.ci || runtime.mode === "json" || organizations.length === 0) return yield* organizationRequired();
 		orgId = yield* Prompt.Select({
 			message: "Organization",
 			choices: organizations.map((org) => ({
@@ -77525,6 +78135,112 @@ const restoreWriteClient = (config, opened, signer, confirmed, refusal) => Effec
 	return write;
 });
 //#endregion
+//#region src/platform/observe-snapshots.ts
+/**
+* Follow an SDK subscription until `onValue` finishes it. An abort, a failed
+* registration, an error snapshot or a failed print settles it too; every
+* progress line is written before it resolves, and teardown runs once.
+*/
+const observeSnapshots = (register, operation, onValue) => Effect.gen(function* () {
+	const runtime = yield* CliRuntime;
+	const run = Effect.runPromiseWith(yield* Effect.context());
+	let output = Promise.resolve();
+	return yield* Effect.promise((signal) => new Promise((resolve) => {
+		let closed = false;
+		let unsubscribe;
+		let previous;
+		const finish = (result) => {
+			if (closed) return;
+			closed = true;
+			signal.removeEventListener("abort", abort);
+			unsubscribe?.();
+			output.then(() => resolve(result), (cause) => resolve({
+				ok: false,
+				error: Errors.unknown(cause)
+			}));
+		};
+		const abort = () => finish({
+			ok: false,
+			error: Errors.cancelled({ operation })
+		});
+		signal.addEventListener("abort", abort, { once: true });
+		const report = (progress, human) => {
+			const semantic = JSON.stringify(progress);
+			if (semantic === previous) return;
+			previous = semantic;
+			const text = runtime.mode === "json" ? semantic : human();
+			output = output.then(() => signal.aborted ? void 0 : run(writeProgress(runtime, `${text}\n`), { signal }));
+			output.catch((cause) => finish({
+				ok: false,
+				error: Errors.unknown(cause)
+			}));
+		};
+		const listener = (snapshot) => {
+			if (closed || snapshot.status === "loading") return;
+			if (snapshot.status === "error") return finish({
+				ok: false,
+				error: snapshot.error
+			});
+			onValue(snapshot.value, {
+				finish,
+				report
+			});
+		};
+		register(listener, signal).then((result) => {
+			if (!result.ok) return finish(result);
+			unsubscribe = result.value;
+			if (closed) unsubscribe();
+		}).catch((cause) => finish({
+			ok: false,
+			error: Errors.unknown(cause)
+		}));
+		if (signal.aborted) abort();
+	})).pipe(Effect.onInterrupt(() => Effect.promise(() => output).pipe(Effect.ignoreCause)));
+});
+//#endregion
+//#region src/commands/org/subcommands/permission/internal/observation-input.ts
+const missing = () => new CliFailure({
+	code: "INVALID_INPUT",
+	outcome: "refused",
+	exitCode: 2,
+	message: "The owned Permission command was not found. Check --org and --request-key."
+});
+const matches$1 = (value, orgId, key) => value.orgId === orgId && value.requestKey === key;
+const mismatch$1 = () => Errors.invalidInput("command", "Permission command response scope does not match");
+const validateObservationInput = (input) => Effect.gen(function* () {
+	const timeout = yield* readWriteTimeout(input.timeoutSeconds);
+	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
+	let rawKey = input.requestKey;
+	if (rawKey !== void 0) {
+		const key = yield* readRequestKey(rawKey);
+		if (rawKey !== key) return yield* inputRequired("Provide one exact --request-key without surrounding whitespace.");
+	}
+	let rawOrg = input.orgs[0];
+	if (input.orgs.length > 1 || rawOrg !== void 0 && /[\p{Cc}\p{Cf}]/u.test(rawOrg)) return yield* inputRequired("Provide one exact --org ID.");
+	if (rawOrg !== void 0) yield* Effect.try({
+		try: () => toOrgId(rawOrg),
+		catch: () => inputRequired("Provide a valid --org ID.")
+	});
+	if (rawOrg === void 0 || rawKey === void 0) {
+		const runtime = yield* CliRuntime;
+		if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* inputRequired(rawOrg === void 0 ? "Provide one exact --org ID." : "Provide --request-key.");
+		if (rawOrg === void 0) rawOrg = yield* Prompt.String({ message: "Exact Organization ID (--org)" });
+	}
+	const orgId = yield* Effect.try({
+		try: () => toOrgId(rawOrg),
+		catch: () => inputRequired("Provide a valid --org ID.")
+	});
+	if (rawKey === void 0) rawKey = yield* Prompt.String({ message: "Original request key (--request-key)" });
+	const key = yield* readRequestKey(rawKey);
+	if (rawKey !== key) return yield* inputRequired("Provide one exact --request-key without surrounding whitespace.");
+	return {
+		orgId,
+		key,
+		timeout,
+		email
+	};
+});
+//#endregion
 //#region src/commands/org/subcommands/permission/internal/command-recovery.ts
 const commandRecovery = (orgId, key, email, commandId) => {
 	const args = [
@@ -77573,6 +78289,112 @@ const commandLines = (view) => [
 	"Verified receipts",
 	...view.verifiedReceipts.length === 0 ? ["  None recorded."] : view.verifiedReceipts.map((receipt) => `  ${terminalText(receipt.transactionHash)}; block ${receipt.blockNumber}; log ${receipt.logIndex}`)
 ];
+/** Where `--wait` ended: only an applied command changed the Permission. */
+const endedLine = (view) => view.status === "applied" ? "Applied." : view.status === "failed" ? "Not applied: the command failed." : view.status === "actionable" ? "Not applied: the command needs action." : "Still pending.";
+//#endregion
+//#region src/commands/org/subcommands/permission/internal/command-observation.ts
+/** The command's state as one progress record: its executions and verified receipts. */
+const commandProgress = (orgId, key, value) => ({
+	type: "permission.command.state",
+	organizationId: orgId,
+	requestKey: key,
+	commandId: value.commandId,
+	status: value.status,
+	state: value.state,
+	executions: value.executions.map((execution) => ({
+		executionId: execution.executionId,
+		state: execution.state,
+		...execution.userOpHash === void 0 ? {} : { userOpHash: execution.userOpHash }
+	})),
+	verifiedReceipts: value.verifiedReceipts.map((receipt) => ({
+		transactionHash: receipt.transactionHash,
+		blockNumber: receipt.blockNumber,
+		logIndex: receipt.logIndex
+	}))
+});
+const commandProgressLines = (value, progress) => [
+	`Permission command ${terminalText(value.commandId)}: ${value.status}; recorded state ${value.state}`,
+	...progress.executions.map((execution) => `  Execution ${terminalText(execution.executionId)}: ${execution.state}${execution.userOpHash === void 0 ? "" : `; user operation ${terminalText(execution.userOpHash)}`}`),
+	...progress.verifiedReceipts.map((receipt) => `  Verified receipt: ${terminalText(receipt.transactionHash)}; block ${receipt.blockNumber}; log ${receipt.logIndex}`)
+].join("\n");
+/** The SDK supplies fresh authorized snapshots; one finish path owns teardown. */
+const observeCommand = (register, orgId, key, seen) => Effect.suspend(() => {
+	let observedId;
+	return observeSnapshots(register, CAPXUL_OPERATIONS.org.permissions.subscribeCommand, (value, { finish, report }) => {
+		if (value === null) return finish({
+			ok: true,
+			value: null
+		});
+		if (!matches$1(value, orgId, key) || observedId !== void 0 && observedId !== value.commandId) return finish({
+			ok: false,
+			error: mismatch$1()
+		});
+		observedId = value.commandId;
+		seen(value);
+		const progress = commandProgress(orgId, key, value);
+		report(progress, () => commandProgressLines(value, progress));
+		if (value.status === "applied" || value.status === "failed" || value.status === "actionable") finish({
+			ok: true,
+			value
+		});
+	});
+}).pipe(Effect.flatMap(resultValue));
+/** Follow the command with fresh SDK snapshots until it is applied, failed or actionable. */
+const followCommand = (methods, orgId, key, seen) => observeCommand((listener, signal) => methods.subscribeCommand(key, listener, { signal }), orgId, key, seen);
+/** Historical reads never select current Organization access or compose a signer. */
+const observeValidatedCommand = (config, input, validated, read) => Effect.gen(function* () {
+	const { orgId, key, timeout } = validated;
+	let email = validated.email;
+	let commandId;
+	const runtime = yield* CliRuntime;
+	const guarded = (work) => work.pipe(Effect.mapError((error) => {
+		const failure = classifyFailure(Cause.fail(error), input.kind === "commandGet" ? "org.permission.command.get" : "org.permission.command.wait");
+		const known = commandRecovery(orgId, key, email, commandId);
+		return new CliFailure({
+			...failure,
+			details: {
+				...failure.details,
+				...known.details
+			},
+			message: `${isCapxulError(error) && error.details?.field === "command" ? "The Permission command response could not be verified." : failure.message}\n${known.lines}`
+		});
+	}), Effect.onInterrupt(() => {
+		const known = commandRecovery(orgId, key, email, commandId);
+		return writeStderr(runtime.mode === "json" ? `${JSON.stringify({
+			type: "permission.command.recovery",
+			...known.details
+		})}\n` : `${known.lines}\n`).pipe(Effect.ignoreCause);
+	}));
+	const restored = yield* guarded(restoreAuthenticatedClient(config, email, { requirement: "none" }));
+	email = restored.session.email;
+	const result = yield* guarded(Effect.gen(function* () {
+		const reading = read(restored.client.org(orgId).permissions, orgId, key, (value) => {
+			commandId = value.commandId;
+		});
+		const view = yield* input.kind === "commandWait" ? withWaiting(reading, {
+			...runtime,
+			label: "Observe Permission command state"
+		}) : reading;
+		if (view === null) return yield* missing();
+		if (!matches$1(view, orgId, key)) return yield* Effect.fail(mismatch$1());
+		commandId = view.commandId;
+		return view;
+	})).pipe(Effect.timeoutOption(timeout * 1e3));
+	if (Option.isNone(result)) {
+		const known = commandRecovery(orgId, key, email, commandId);
+		return yield* new CliFailure({
+			code: "CLI_DEADLINE",
+			outcome: "failed",
+			exitCode: 5,
+			details: known.details,
+			message: `The CLI stopped waiting. Permission application is not confirmed.\n${known.lines}`
+		});
+	}
+	return {
+		data: { command: result.value },
+		lines: commandLines(result.value)
+	};
+});
 //#endregion
 //#region src/commands/org/subcommands/permission/internal/write-target.ts
 /** Read what the confirmed write targets: the replacement preview, the assignment, or the policy. */
@@ -77634,7 +78456,7 @@ const writeValidatedPermission = (config, input, validated, submit) => Effect.ge
 		lines,
 		question: selection.kind === "replace" ? "Replace this module with this complete authority scope?" : selection.kind === "assign" ? "Assign this Permission to this Account?" : selection.kind === "revoke" ? "Revoke only this assignment?" : "Confirm this complete policy?"
 	});
-	else if (runtime.mode !== "json") yield* writeStderr(`${lines.join("\n")}\n`);
+	else if (runtime.mode !== "json") yield* writeProgress(runtime, `${lines.join("\n")}\n`);
 	else yield* writeStderr(`${JSON.stringify({
 		type: "permission.preview",
 		organizationId: orgId,
@@ -77706,19 +78528,40 @@ const writeValidatedPermission = (config, input, validated, submit) => Effect.ge
 		details: recovery(),
 		message: `The CLI stopped waiting. Permission application is not confirmed.\n${recoveryText()}`
 	});
-	return {
+	const execution = result.value;
+	if (input.wait !== true) return {
 		data: {
-			execution: result.value,
+			execution,
 			requestKey: key
 		},
 		lines: [
-			selection.kind === "assign" ? "Submitted. Assignment is pending application." : selection.kind === "revoke" ? "Submitted. Assignment removal is pending application." : selection.kind === "replace" ? "Submitted. Module replacement is pending application." : "Submitted. The Permission is pending application.",
-			`Command: ${terminalText(result.value.commandId)}`,
-			`Execution: ${terminalText(result.value.executionId)}`,
+			submittedLine(selection.kind),
+			`Command: ${terminalText(execution.commandId)}`,
+			`Execution: ${terminalText(execution.executionId)}`,
 			`Request key: ${key}`,
 			commandRecovery(orgId, key, preview.session.email).lines
 		]
 	};
+	const followed = yield* observeValidatedCommand(config, {
+		kind: "commandWait",
+		orgs: [orgId],
+		email: preview.session.email,
+		requestKey: key,
+		timeoutSeconds: input.timeoutSeconds
+	}, {
+		orgId,
+		key,
+		timeout,
+		email: preview.session.email
+	}, followCommand);
+	return {
+		data: {
+			execution,
+			requestKey: key,
+			command: followed.data.command
+		},
+		lines: [endedLine(followed.data.command), ...commandLines(followed.data.command)]
+	};
 });
 //#endregion
 //#region src/commands/org/subcommands/permission/subcommands/create/execute.ts
@@ -77742,14 +78585,16 @@ const command$40 = Command.make("create", {
 	input: sourceFlag$2,
 	requestKey: requestKeyFlag$2,
 	confirm: confirmFlag$1,
+	wait: waitFlag,
 	timeoutSeconds: timeoutFlag$2
-}, ({ email, input, requestKey, confirm, timeoutSeconds }) => dispatch$2("create", (config, orgs) => execute$42(config, {
+}, ({ email, input, requestKey, confirm, wait, timeoutSeconds }) => dispatch$2("create", (config, orgs) => execute$42(config, {
 	kind: "create",
 	orgs,
 	email: Option.getOrUndefined(email),
 	source: Option.getOrUndefined(input),
 	requestKey: Option.getOrUndefined(requestKey),
 	confirm,
+	wait,
 	timeoutSeconds
 }))).pipe(annotate$2("create"), Command.withDescription("Create a Permission from its complete policy"));
 //#endregion
@@ -77776,8 +78621,9 @@ const command$39 = Command.make("change", {
 	input: sourceFlag$2,
 	requestKey: requestKeyFlag$2,
 	confirm: confirmFlag$1,
+	wait: waitFlag,
 	timeoutSeconds: timeoutFlag$2
-}, ({ email, permissionId, input, requestKey, confirm, timeoutSeconds }) => dispatch$2("change", (config, orgs) => execute$41(config, {
+}, ({ email, permissionId, input, requestKey, confirm, wait, timeoutSeconds }) => dispatch$2("change", (config, orgs) => execute$41(config, {
 	kind: "change",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -77785,6 +78631,7 @@ const command$39 = Command.make("change", {
 	source: Option.getOrUndefined(input),
 	requestKey: Option.getOrUndefined(requestKey),
 	confirm,
+	wait,
 	timeoutSeconds
 }))).pipe(annotate$2("change"), Command.withDescription("Replace one active Permission's complete policy"));
 //#endregion
@@ -77813,8 +78660,9 @@ const command$38 = Command.make("assign", {
 	expectedMemberEmail: expectedMemberEmailFlag,
 	requestKey: requestKeyFlag$2,
 	confirm: confirmFlag$1,
+	wait: waitFlag,
 	timeoutSeconds: timeoutFlag$2
-}, ({ email, permissionId, accountId, expectedMemberEmail, requestKey, confirm, timeoutSeconds }) => dispatch$2("assign", (config, orgs) => execute$40(config, {
+}, ({ email, permissionId, accountId, expectedMemberEmail, requestKey, confirm, wait, timeoutSeconds }) => dispatch$2("assign", (config, orgs) => execute$40(config, {
 	kind: "assign",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -77823,6 +78671,7 @@ const command$38 = Command.make("assign", {
 	expectedMemberEmail: Option.getOrUndefined(expectedMemberEmail),
 	requestKey: Option.getOrUndefined(requestKey),
 	confirm,
+	wait,
 	timeoutSeconds
 }))).pipe(annotate$2("assign"), Command.withDescription("Assign one active Permission to one exact Account"));
 //#endregion
@@ -77847,14 +78696,16 @@ const command$37 = Command.make("revoke", {
 	assignmentId: assignmentIdArgument,
 	requestKey: requestKeyFlag$2,
 	confirm: confirmFlag$1,
+	wait: waitFlag,
 	timeoutSeconds: timeoutFlag$2
-}, ({ email, assignmentId, requestKey, confirm, timeoutSeconds }) => dispatch$2("revoke", (config, orgs) => execute$39(config, {
+}, ({ email, assignmentId, requestKey, confirm, wait, timeoutSeconds }) => dispatch$2("revoke", (config, orgs) => execute$39(config, {
 	kind: "revoke",
 	orgs,
 	email: Option.getOrUndefined(email),
 	assignmentId: Option.getOrUndefined(assignmentId),
 	requestKey: Option.getOrUndefined(requestKey),
 	confirm,
+	wait,
 	timeoutSeconds
 }))).pipe(annotate$2("revoke"), Command.withDescription("Revoke one exact active Permission assignment"));
 //#endregion
@@ -77878,224 +78729,18 @@ const command$36 = Command.make("replace", {
 	email: emailFlag$2,
 	requestKey: requestKeyFlag$2,
 	confirm: confirmFlag$1,
+	wait: waitFlag,
 	timeoutSeconds: timeoutFlag$2
-}, ({ email, requestKey, confirm, timeoutSeconds }) => dispatch$2("replace", (config, orgs) => execute$38(config, {
+}, ({ email, requestKey, confirm, wait, timeoutSeconds }) => dispatch$2("replace", (config, orgs) => execute$38(config, {
 	kind: "replace",
 	orgs,
 	email: Option.getOrUndefined(email),
 	requestKey: Option.getOrUndefined(requestKey),
 	confirm,
+	wait,
 	timeoutSeconds
 }))).pipe(annotate$2("replace"), Command.withDescription("Replace the current Roles module with its complete authority scope"));
 //#endregion
-//#region src/platform/observe-snapshots.ts
-/**
-* Follow an SDK subscription until `onValue` finishes it. An abort, a failed
-* registration, an error snapshot or a failed print settles it too; every
-* progress line is written before it resolves, and teardown runs once.
-*/
-const observeSnapshots = (register, operation, onValue) => Effect.gen(function* () {
-	const runtime = yield* CliRuntime;
-	const run = Effect.runPromiseWith(yield* Effect.context());
-	let output = Promise.resolve();
-	return yield* Effect.promise((signal) => new Promise((resolve) => {
-		let closed = false;
-		let unsubscribe;
-		let previous;
-		const finish = (result) => {
-			if (closed) return;
-			closed = true;
-			signal.removeEventListener("abort", abort);
-			unsubscribe?.();
-			output.then(() => resolve(result), (cause) => resolve({
-				ok: false,
-				error: Errors.unknown(cause)
-			}));
-		};
-		const abort = () => finish({
-			ok: false,
-			error: Errors.cancelled({ operation })
-		});
-		signal.addEventListener("abort", abort, { once: true });
-		const report = (progress, human) => {
-			const semantic = JSON.stringify(progress);
-			if (semantic === previous) return;
-			previous = semantic;
-			const text = runtime.mode === "json" ? semantic : human();
-			output = output.then(() => signal.aborted ? void 0 : run(writeStderr(`${text}\n`), { signal }));
-			output.catch((cause) => finish({
-				ok: false,
-				error: Errors.unknown(cause)
-			}));
-		};
-		const listener = (snapshot) => {
-			if (closed || snapshot.status === "loading") return;
-			if (snapshot.status === "error") return finish({
-				ok: false,
-				error: snapshot.error
-			});
-			onValue(snapshot.value, {
-				finish,
-				report
-			});
-		};
-		register(listener, signal).then((result) => {
-			if (!result.ok) return finish(result);
-			unsubscribe = result.value;
-			if (closed) unsubscribe();
-		}).catch((cause) => finish({
-			ok: false,
-			error: Errors.unknown(cause)
-		}));
-		if (signal.aborted) abort();
-	})).pipe(Effect.onInterrupt(() => Effect.promise(() => output).pipe(Effect.ignoreCause)));
-});
-//#endregion
-//#region src/commands/org/subcommands/permission/internal/observation-input.ts
-const missing = () => new CliFailure({
-	code: "INVALID_INPUT",
-	outcome: "refused",
-	exitCode: 2,
-	message: "The owned Permission command was not found. Check --org and --request-key."
-});
-const matches$1 = (value, orgId, key) => value.orgId === orgId && value.requestKey === key;
-const mismatch$1 = () => Errors.invalidInput("command", "Permission command response scope does not match");
-const validateObservationInput = (input) => Effect.gen(function* () {
-	const timeout = yield* readWriteTimeout(input.timeoutSeconds);
-	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
-	let rawKey = input.requestKey;
-	if (rawKey !== void 0) {
-		const key = yield* readRequestKey(rawKey);
-		if (rawKey !== key) return yield* inputRequired("Provide one exact --request-key without surrounding whitespace.");
-	}
-	let rawOrg = input.orgs[0];
-	if (input.orgs.length > 1 || rawOrg !== void 0 && /[\p{Cc}\p{Cf}]/u.test(rawOrg)) return yield* inputRequired("Provide one exact --org ID.");
-	if (rawOrg !== void 0) yield* Effect.try({
-		try: () => toOrgId(rawOrg),
-		catch: () => inputRequired("Provide a valid --org ID.")
-	});
-	if (rawOrg === void 0 || rawKey === void 0) {
-		const runtime = yield* CliRuntime;
-		if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* inputRequired(rawOrg === void 0 ? "Provide one exact --org ID." : "Provide --request-key.");
-		if (rawOrg === void 0) rawOrg = yield* Prompt.String({ message: "Exact Organization ID (--org)" });
-	}
-	const orgId = yield* Effect.try({
-		try: () => toOrgId(rawOrg),
-		catch: () => inputRequired("Provide a valid --org ID.")
-	});
-	if (rawKey === void 0) rawKey = yield* Prompt.String({ message: "Original request key (--request-key)" });
-	const key = yield* readRequestKey(rawKey);
-	if (rawKey !== key) return yield* inputRequired("Provide one exact --request-key without surrounding whitespace.");
-	return {
-		orgId,
-		key,
-		timeout,
-		email
-	};
-});
-//#endregion
-//#region src/commands/org/subcommands/permission/internal/command-observation.ts
-/** The command's state as one progress record: its executions and verified receipts. */
-const commandProgress = (orgId, key, value) => ({
-	type: "permission.command.state",
-	organizationId: orgId,
-	requestKey: key,
-	commandId: value.commandId,
-	status: value.status,
-	state: value.state,
-	executions: value.executions.map((execution) => ({
-		executionId: execution.executionId,
-		state: execution.state,
-		...execution.userOpHash === void 0 ? {} : { userOpHash: execution.userOpHash }
-	})),
-	verifiedReceipts: value.verifiedReceipts.map((receipt) => ({
-		transactionHash: receipt.transactionHash,
-		blockNumber: receipt.blockNumber,
-		logIndex: receipt.logIndex
-	}))
-});
-const commandProgressLines = (value, progress) => [
-	`Permission command ${terminalText(value.commandId)}: ${value.status}; recorded state ${value.state}`,
-	...progress.executions.map((execution) => `  Execution ${terminalText(execution.executionId)}: ${execution.state}${execution.userOpHash === void 0 ? "" : `; user operation ${terminalText(execution.userOpHash)}`}`),
-	...progress.verifiedReceipts.map((receipt) => `  Verified receipt: ${terminalText(receipt.transactionHash)}; block ${receipt.blockNumber}; log ${receipt.logIndex}`)
-].join("\n");
-/** The SDK supplies fresh authorized snapshots; one finish path owns teardown. */
-const observeCommand = (register, orgId, key, seen) => Effect.suspend(() => {
-	let observedId;
-	return observeSnapshots(register, CAPXUL_OPERATIONS.org.permissions.subscribeCommand, (value, { finish, report }) => {
-		if (value === null) return finish({
-			ok: true,
-			value: null
-		});
-		if (!matches$1(value, orgId, key) || observedId !== void 0 && observedId !== value.commandId) return finish({
-			ok: false,
-			error: mismatch$1()
-		});
-		observedId = value.commandId;
-		seen(value);
-		const progress = commandProgress(orgId, key, value);
-		report(progress, () => commandProgressLines(value, progress));
-		if (value.status === "applied" || value.status === "failed" || value.status === "actionable") finish({
-			ok: true,
-			value
-		});
-	});
-}).pipe(Effect.flatMap(resultValue));
-/** Historical reads never select current Organization access or compose a signer. */
-const observeValidatedCommand = (config, input, validated, read) => Effect.gen(function* () {
-	const { orgId, key, timeout } = validated;
-	let email = validated.email;
-	let commandId;
-	const runtime = yield* CliRuntime;
-	const result = yield* Effect.gen(function* () {
-		const restored = yield* restoreAuthenticatedClient(config, email, { requirement: "none" });
-		email = restored.session.email;
-		const methods = restored.client.org(orgId).permissions;
-		const reading = read(methods, orgId, key, (value) => {
-			commandId = value.commandId;
-		});
-		const view = yield* input.kind === "commandWait" ? withWaiting(reading, {
-			...runtime,
-			label: "Observe Permission command state"
-		}) : reading;
-		if (view === null) return yield* missing();
-		if (!matches$1(view, orgId, key)) return yield* Effect.fail(mismatch$1());
-		commandId = view.commandId;
-		return view;
-	}).pipe(Effect.mapError((error) => {
-		const failure = classifyFailure(Cause.fail(error), input.kind === "commandGet" ? "org.permission.command.get" : "org.permission.command.wait");
-		const known = commandRecovery(orgId, key, email, commandId);
-		return new CliFailure({
-			...failure,
-			details: {
-				...failure.details,
-				...known.details
-			},
-			message: `${isCapxulError(error) && error.details?.field === "command" ? "The Permission command response could not be verified." : failure.message}\n${known.lines}`
-		});
-	}), Effect.onInterrupt(() => {
-		const known = commandRecovery(orgId, key, email, commandId);
-		return writeStderr(runtime.mode === "json" ? `${JSON.stringify({
-			type: "permission.command.recovery",
-			...known.details
-		})}\n` : `${known.lines}\n`).pipe(Effect.ignoreCause);
-	}), Effect.timeoutOption(timeout * 1e3));
-	if (Option.isNone(result)) {
-		const known = commandRecovery(orgId, key, email, commandId);
-		return yield* new CliFailure({
-			code: "CLI_DEADLINE",
-			outcome: "failed",
-			exitCode: 5,
-			details: known.details,
-			message: `The CLI stopped waiting. Permission application is not confirmed.\n${known.lines}`
-		});
-	}
-	return {
-		data: { command: result.value },
-		lines: commandLines(result.value)
-	};
-});
-//#endregion
 //#region src/commands/org/subcommands/permission/subcommands/command/subcommands/get/execute.ts
 const execute$37 = (config, input) => Effect.gen(function* () {
 	const validated = yield* validateObservationInput(input);
@@ -78118,7 +78763,7 @@ const command$35 = Command.make("get", {
 //#region src/commands/org/subcommands/permission/subcommands/command/subcommands/wait/execute.ts
 const execute$36 = (config, input) => Effect.gen(function* () {
 	const validated = yield* validateObservationInput(input);
-	return yield* observeValidatedCommand(config, input, validated, (methods, orgId, key, seen) => observeCommand((listener, signal) => methods.subscribeCommand(key, listener, { signal }), orgId, key, seen));
+	return yield* observeValidatedCommand(config, input, validated, followCommand);
 });
 //#endregion
 //#region src/commands/org/subcommands/permission/subcommands/command/subcommands/wait/command.ts
@@ -78150,14 +78795,14 @@ const permission = Command.make("permission").pipe(annotate$2("root"), Command.w
 ]));
 //#endregion
 //#region src/commands/org/subcommands/payroll/subcommands/shared.ts
-const emailFlag$1 = Flag.String("email").pipe(Flag.optional);
-const sourceFlag$1 = Flag.String("input").pipe(Flag.atLeast(0));
+const emailFlag$1 = Flag.String("email").pipe(Flag.withDescription(FLAG_HELP.email), Flag.optional);
+const sourceFlag$1 = Flag.String("input").pipe(Flag.withDescription(FLAG_HELP.input), Flag.atLeast(0));
 const groupIdArgument = Argument.String("id").pipe(Argument.withDescription("The payroll group ID"), Argument.optional, Argument.map(Option.toArray));
 const runIdArgument = Argument.String("id").pipe(Argument.withDescription("The Payroll run ID"), Argument.optional, Argument.map(Option.toArray));
-const requestKeyFlag$1 = Flag.String("request-key").pipe(Flag.atLeast(0));
-const resumeFlag = Flag.String("resume").pipe(Flag.atLeast(0));
-const confirmFlag = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
-const timeoutFlag$1 = Flag.Int("timeout-seconds").pipe(Flag.withDefault(120));
+const requestKeyFlag$1 = Flag.String("request-key").pipe(Flag.withDescription("a key that makes repeating the same run safe"), Flag.atLeast(0));
+const resumeFlag = Flag.String("resume").pipe(Flag.withDescription("prepare a saved run again, by its request key"), Flag.atLeast(0));
+const confirmFlag = Flag.Boolean("confirm").pipe(Flag.withDescription(FLAG_HELP.confirm), Flag.withDefault(false));
+const timeoutFlag$1 = Flag.Int("timeout-seconds").pipe(Flag.withDescription(FLAG_HELP.timeout), Flag.withDefault(120));
 const names$1 = {
 	root: "org.payroll",
 	groups: "org.payroll.groups",
@@ -78196,7 +78841,7 @@ const selectOrganization = (organizations, selected) => Effect.gen(function* ()
 	let orgId = selected;
 	if (orgId === null) {
 		const runtime = yield* CliRuntime;
-		if (!runtime.tty || runtime.ci || runtime.mode === "json" || organizations.length === 0) return yield* inputRequired("Provide --org, or choose one with: capxul use org <handle>");
+		if (!runtime.tty || runtime.ci || runtime.mode === "json" || organizations.length === 0) return yield* organizationRequired();
 		orgId = yield* Prompt.Select({
 			message: "Organization",
 			choices: organizations.map((org) => ({
@@ -78382,10 +79027,10 @@ const runLines$1 = (value) => [
 	...value.items.length === 0 ? ["No Payroll runs found."] : value.items.flatMap((run) => [
 		`Run: ${terminalText(run.id)} (${terminalText(run.status)})`,
 		`  Period (epoch ms): ${run.periodStart} to ${run.periodEnd}; recipients: ${run.recipientCount}`,
-		`  Total: ${terminalText(run.total.value)} ${terminalText(run.total.asset)}`
+		`  Total: ${terminalText(shownNumber(run.total))} ${terminalText(assetName(run.total.asset))}`
 	]),
 	"Settled this month (backend totals)",
-	...value.settledThisMonth.length === 0 ? ["  No settled asset totals."] : value.settledThisMonth.map((total) => `  ${terminalText(total.value)} ${terminalText(total.asset)}`)
+	...value.settledThisMonth.length === 0 ? ["  No settled asset totals."] : value.settledThisMonth.map((total) => `  ${terminalText(shownNumber(total))} ${terminalText(assetName(total.asset))}`)
 ];
 //#endregion
 //#region src/commands/org/subcommands/payroll/subcommands/groups/subcommands/list/execute.ts
@@ -78756,7 +79401,7 @@ const guideRunInput = (budgets, groups, terms, contacts) => Effect.gen(function*
 	const asset = yield* Prompt.Select({
 		message: "Settlement asset",
 		choices: assets.map((value) => ({
-			title: `${terminalText(requireAsset(value).symbol)} (${terminalText(value)})`,
+			title: terminalText(assetName(value)),
 			value
 		}))
 	});
@@ -78843,6 +79488,47 @@ const guideRunInput = (budgets, groups, terms, contacts) => Effect.gen(function*
 	});
 });
 //#endregion
+//#region src/commands/org/subcommands/payroll/internal/run-lookup.ts
+const isPayrollRunId = (value) => /^payroll_run_[0-9a-f]{64}$/u.test(value);
+const exactRunId = (value) => isPayrollRunId(value) ? Effect.succeed(value) : Effect.fail(inputRequired("Provide the Payroll run ID: payroll_run_ followed by a 64-character digest."));
+const validateRunInput = (input) => Effect.gen(function* () {
+	const timeout = yield* readWriteTimeout(input.timeoutSeconds);
+	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
+	if (input.orgs.length > 1) return yield* inputRequired("Provide one exact --org ID.");
+	const orgId = yield* explicitOrganization(input.orgs);
+	if (input.runIds.length > 1) return yield* inputRequired("Provide one exact Payroll run ID.");
+	let runId = input.runIds[0];
+	if (runId !== void 0) yield* exactRunId(runId);
+	const runtime = yield* CliRuntime;
+	if (!runtime.tty || runtime.ci || runtime.mode === "json") {
+		if (orgId === null) return yield* inputRequired("Provide one exact --org ID.");
+		if (runId === void 0) return yield* inputRequired("Provide the Payroll run ID.");
+	}
+	if (runId === void 0) runId = yield* Prompt.String({ message: "Payroll run ID" });
+	return {
+		orgId,
+		runId: yield* exactRunId(runId),
+		timeout,
+		email
+	};
+});
+const missingRun = () => new CliFailure({
+	code: "INVALID_INPUT",
+	outcome: "refused",
+	exitCode: 2,
+	message: "The Payroll run was not found or is unavailable to this session. Check --org and the Payroll run ID."
+});
+const matches = (detail, orgId, runId) => detail.orgId === orgId && detail.run.id === runId;
+const mismatch = () => Errors.invalidInput("runId", "Payroll run response scope does not match");
+const finishedRun = (detail) => detail.items.length > 0 && detail.items.every((item) => paymentPhase(item.payment.status).outcome === "good") || detail.items.some((item) => {
+	const phase = paymentPhase(item.payment.status);
+	return phase.terminal && phase.outcome !== "good" || phase.needsAction || item.payment.execution?.retryRequired === true;
+}) || [
+	"failed",
+	"mismatch",
+	"unresolved"
+].includes(detail.command.verificationState) || detail.command.completionOutcome === "failed" || detail.command.terminalOutcome !== void 0 && detail.command.terminalOutcome !== "settled";
+//#endregion
 //#region src/commands/org/subcommands/payroll/internal/run-preview.ts
 /** The recovery a Payroll run prints: resume the saved input, or read and wait for the run. */
 const runCommandRecovery = (input) => {
@@ -78896,6 +79582,19 @@ const runCommandRecovery = (input) => {
 		]
 	};
 };
+/**
+* The backend's refusal for a request key whose run already settled or failed
+* (#2383): the run to read. Resuming that key returns the same refusal.
+*/
+const completedRun = (error, key) => {
+	if (!isCapxulError(error) || error.code !== "WRONG_STATE") return void 0;
+	const runId = error.details?.runId;
+	const resolution = error.details?.payrollResolution;
+	return typeof runId === "string" && isPayrollRunId(runId) && error.details?.requestKey === key && (resolution === "settled" || resolution === "failed") ? {
+		runId,
+		resolution
+	} : void 0;
+};
 /** Each Payroll recipient resolves to its asserted known Party and Safe, never an external address; each item comes back with its target. */
 const resolveRunTargets = (client, items) => Effect.forEach(items, (item) => Effect.promise((signal) => client.targets.resolve(item.to, { signal })).pipe(Effect.flatMap(resultValue), Effect.flatMap((target) => {
 	if (target.kind === "external_address" || target.requiresAcknowledgement === true) return Effect.fail(inputRequired("External-address Payroll requires an explicit acknowledgement before sending."));
@@ -78913,14 +79612,14 @@ const runPreviewLines = (input) => {
 		`Acting as: ${terminalText(preview.session.email)} (${terminalText(preview.session.authUserId)})`,
 		`Organization: ${terminalText(selectedOrg)}`,
 		`Budget: ${terminalText(budget.label)} (${terminalText(budget.id)})`,
-		`Per-payment cap: ${budget.limit === null ? "unlimited" : terminalText(budget.limit.value)} ${terminalText(requested.asset)}`,
-		`Settlement asset: ${terminalText(requested.asset)}`,
+		`Per-payment cap: ${budget.limit === null ? "unlimited" : terminalText(budget.limit.value)} ${terminalText(assetName(requested.asset))}`,
+		`Settlement asset: ${terminalText(assetName(requested.asset))}`,
 		`Period (epoch ms): ${requested.period.start} to ${requested.period.end}`,
 		`Request key: ${terminalText(key)}`,
 		...employees.flatMap(({ item, target }, index) => [
 			`Employee ${index + 1}: ${terminalText(target.label)} (${terminalText(item.partyId)})`,
 			`  Recipient: ${terminalText(JSON.stringify(item.to))}; Safe: ${terminalText(target.safeAddress)}`,
-			`  Payout quantity: ${terminalText(item.amount.value)} ${terminalText(item.amount.asset)}`,
+			`  Payout quantity: ${terminalText(item.amount.value)} ${terminalText(assetName(item.amount.asset))}`,
 			`  Gross: ${terminalText(item.gross)} raw units; net: ${terminalText(item.net)} raw units`,
 			...item.adjustments.map((row) => `  Adjustment: ${terminalText(row.label)}; ${terminalText(row.amount)} raw units`)
 		])
@@ -79085,21 +79784,34 @@ const followApproval = (client, approvalId, options) => Effect.gen(function* ()
 	onNone: () => Effect.fail(stillWaiting(approvalId, options)),
 	onSome: Effect.succeed
 })));
-/** `Paid 50.00 USDC to Rex · 0x5b2e…91c4`, and where the receipt is. */
+/** `Paid 50.00 USDC to Rex · 0x5b2e…91c4`, where the receipt is, and how to save it as PDF. */
 const paidLines = (outcome, scope = {}) => outcome.payments.flatMap((payment) => {
 	const hash = payment.receipt?.transactionHash;
-	return [`Paid ${shownAmount(payment.amount)} to ${terminalText(payment.counterpartyLabel)}${hash === void 0 ? "" : ` · ${hash.slice(0, 6)}…${hash.slice(-4)}`}`, `receipt: ${terminalText([
-		"capxul",
-		"payment",
-		"get",
-		payment.id,
-		...scoped(scope)
-	].join(" "))}`];
+	return [
+		`Paid ${shownAmount(payment.amount)} to ${terminalText(payment.counterpartyLabel)}${hash === void 0 ? "" : ` · ${hash.slice(0, 6)}…${hash.slice(-4)}`}`,
+		`receipt: ${terminalText([
+			"capxul",
+			"payment",
+			"get",
+			payment.id,
+			...scoped(scope)
+		].join(" "))}`,
+		...saveDocumentLines(payment)
+	];
 });
-/** A progress line for a person, on stderr. */
-const progress = (line) => writeStderr(`${line}\n`);
+/** A progress line for a person, on stderr at a terminal. */
+const progress = (reader, line) => writeProgress(reader, `${line}\n`);
+/** What the person must do: shown even when output is piped, like a prompt. */
+const instruction = (line) => writeStderr(`${line}\n`);
 /** After the approval lapses, the time a send and its settlement may still take. */
 const SETTLE_MS = 12e4;
+/** How long to follow an approval that lapses at `expiresAt`: until then, plus the settlement. */
+const untilLapseMs = (expiresAt, now) => Math.max(expiresAt - now, 0) + SETTLE_MS;
+/** The default wait for an approval ID: as long as `payment send` follows it. */
+const followUntilLapseMs = (client, approvalId) => Effect.gen(function* () {
+	const approval = yield* read(client, approvalId);
+	return untilLapseMs(approval.expiresAt, yield* Clock.currentTimeMillis);
+});
 /**
 * Hand a prepared approval over. An agent gets the link and the wait command
 * back at once. A person sees the preview, the approval page opens, and the
@@ -79112,18 +79824,18 @@ const handOver = (client, approval, options) => Effect.gen(function* () {
 		data: awaitingApproval(approval, options),
 		lines: []
 	};
-	for (const line of previewLines(approval, options)) yield* progress(line);
-	yield* progress("✓ Prepared");
+	for (const line of previewLines(approval, options)) yield* progress(runtime, line);
+	yield* progress(runtime, "✓ Prepared");
 	const opened = runtime.tty && !runtime.ci ? yield* openUrl(approval.url) : false;
-	yield* progress(`… Approve in your browser${opened ? " (opened)" : ""}`);
-	yield* progress(`  ${approval.url}`);
+	yield* instruction(`… Approve in your browser${opened ? " (opened)" : ""}`);
+	yield* instruction(`  ${approval.url}`);
 	const now = yield* Clock.currentTimeMillis;
 	const outcome = yield* followApproval(client, approval.approvalId, {
 		organizationId: options.organizationId,
-		deadlineMs: options.timeoutSeconds === void 0 ? Math.max(approval.expiresAt - now, 0) + SETTLE_MS : options.timeoutSeconds * 1e3,
-		onSigned: progress("✓ Signed")
-	}).pipe(Effect.onInterrupt(() => progress(`Nothing is sent until you approve. Follow it with: ${waitArgv(approval.approvalId, options).join(" ")}`).pipe(Effect.ignore)));
-	yield* progress("✓ Confirmed");
+		deadlineMs: options.timeoutSeconds === void 0 ? untilLapseMs(approval.expiresAt, now) : options.timeoutSeconds * 1e3,
+		onSigned: progress(runtime, "✓ Signed")
+	}).pipe(Effect.onInterrupt(() => instruction(`Nothing is sent until you approve. Follow it with: ${waitArgv(approval.approvalId, options).join(" ")}`).pipe(Effect.ignore)));
+	yield* progress(runtime, "✓ Confirmed");
 	return {
 		data: outcome,
 		lines: paidLines(outcome, options)
@@ -79146,13 +79858,18 @@ const execute$30 = (config, input) => Effect.gen(function* () {
 		runId: void 0,
 		canResume: saved
 	});
-	const notice = (type) => {
+	const noticeText = (type) => {
 		const known = recovery();
-		return writeStderr(runtime.mode === "json" ? `${JSON.stringify({
+		return runtime.mode === "json" ? `${JSON.stringify({
 			type,
 			...known.details
-		})}\n` : `${known.lines.join("\n")}\n`);
+		})}\n` : `${known.lines.join("\n")}\n`;
 	};
+	const keyNotice = (type) => runtime.mode === "json" ? writeProgress(runtime, `${JSON.stringify({
+		type,
+		organizationId: orgId,
+		requestKey: key
+	})}\n`) : Effect.void;
 	const within = (work) => boundedNetwork(work, timeout);
 	return yield* Effect.gen(function* () {
 		const opened = yield* openAuthenticatedSession(config, email);
@@ -79185,18 +79902,18 @@ const execute$30 = (config, input) => Effect.gen(function* () {
 			employees,
 			key
 		});
-		yield* writeStderr(runtime.mode === "json" ? `${JSON.stringify({
+		yield* writeProgress(runtime, runtime.mode === "json" ? `${JSON.stringify({
 			type: "org.payroll.preview",
 			organizationId: selectedOrg,
 			requestKey: key,
 			input: requested,
 			targets
 		})}\n` : `${lines.join("\n")}\n`);
-		yield* notice("org.payroll.requestKey");
+		yield* keyNotice("org.payroll.requestKey");
 		const draft = stored ?? (yield* saveCommandDraft(config, selector, requested, preview.stillAuthenticated));
 		saved = true;
 		const admitted = yield* parseRunInput(draft.input);
-		yield* notice("org.payroll.saved");
+		yield* keyNotice("org.payroll.saved");
 		const approval = yield* within(withWaiting(Effect.promise((signal) => preview.client.approvals.prepare({
 			organizationId: selectedOrg,
 			payrollRun: {
@@ -79214,16 +79931,24 @@ const execute$30 = (config, input) => Effect.gen(function* () {
 	}).pipe(Effect.mapError((error) => {
 		const scoped = orgId === null ? error : normalizeOrganizationReadFailure(error, orgId);
 		const failure = classifyFailure(Cause.fail(scoped), operation);
-		const known = recovery();
+		const done = completedRun(error, key);
+		const known = done === void 0 ? recovery() : runCommandRecovery({
+			orgId,
+			actorEmail,
+			key,
+			runId: done.runId,
+			canResume: false
+		});
+		const message = done === void 0 ? failure.message : `This request key's Payroll run already ${done.resolution}. Read it below; a new run needs a new --request-key.`;
 		return new CliFailure({
 			...failure,
 			details: {
 				...failure.details,
 				...known.details
 			},
-			message: `${failure.message}${known.lines.length === 0 ? "" : `\n${known.lines.join("\n")}`}`
+			message: `${message}${known.lines.length === 0 ? "" : `\n${known.lines.join("\n")}`}`
 		});
-	}), Effect.onInterrupt(() => notice("org.payroll.recovery").pipe(Effect.ignoreCause)));
+	}), Effect.onInterrupt(() => writeStderr(noticeText("org.payroll.recovery")).pipe(Effect.ignoreCause)));
 });
 //#endregion
 //#region src/commands/org/subcommands/payroll/subcommands/run/command.ts
@@ -79243,47 +79968,6 @@ const command$27 = Command.make("run", {
 	timeoutSeconds: timeout
 }))).pipe(annotate$1("run"), Command.withDescription("run payroll from a Budget; you approve it in the browser"));
 //#endregion
-//#region src/commands/org/subcommands/payroll/internal/run-lookup.ts
-const isPayrollRunId = (value) => /^payroll_run_[0-9a-f]{64}$/u.test(value);
-const exactRunId = (value) => isPayrollRunId(value) ? Effect.succeed(value) : Effect.fail(inputRequired("Provide the Payroll run ID: payroll_run_ followed by a 64-character digest."));
-const validateRunInput = (input) => Effect.gen(function* () {
-	const timeout = yield* readWriteTimeout(input.timeoutSeconds);
-	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
-	if (input.orgs.length > 1) return yield* inputRequired("Provide one exact --org ID.");
-	const orgId = yield* explicitOrganization(input.orgs);
-	if (input.runIds.length > 1) return yield* inputRequired("Provide one exact Payroll run ID.");
-	let runId = input.runIds[0];
-	if (runId !== void 0) yield* exactRunId(runId);
-	const runtime = yield* CliRuntime;
-	if (!runtime.tty || runtime.ci || runtime.mode === "json") {
-		if (orgId === null) return yield* inputRequired("Provide one exact --org ID.");
-		if (runId === void 0) return yield* inputRequired("Provide the Payroll run ID.");
-	}
-	if (runId === void 0) runId = yield* Prompt.String({ message: "Payroll run ID" });
-	return {
-		orgId,
-		runId: yield* exactRunId(runId),
-		timeout,
-		email
-	};
-});
-const missingRun = () => new CliFailure({
-	code: "INVALID_INPUT",
-	outcome: "refused",
-	exitCode: 2,
-	message: "The Payroll run was not found or is unavailable to this session. Check --org and the Payroll run ID."
-});
-const matches = (detail, orgId, runId) => detail.orgId === orgId && detail.run.id === runId;
-const mismatch = () => Errors.invalidInput("runId", "Payroll run response scope does not match");
-const finishedRun = (detail) => detail.items.length > 0 && detail.items.every((item) => paymentPhase(item.payment.status).outcome === "good") || detail.items.some((item) => {
-	const phase = paymentPhase(item.payment.status);
-	return phase.terminal && phase.outcome !== "good" || phase.needsAction || item.payment.execution?.retryRequired === true;
-}) || [
-	"failed",
-	"mismatch",
-	"unresolved"
-].includes(detail.command.verificationState) || detail.command.completionOutcome === "failed" || detail.command.terminalOutcome !== void 0 && detail.command.terminalOutcome !== "settled";
-//#endregion
 //#region src/commands/org/subcommands/payroll/internal/run-lines.ts
 const runRecovery = (orgId, runId, email, command) => {
 	const args = [
@@ -79320,7 +80004,7 @@ const runDetailLines = (detail) => [
 	`Payroll run ${terminalText(detail.run.id)}: recorded status ${detail.run.status}`,
 	`  Organization: ${terminalText(detail.orgId)}`,
 	`  Period: ${detail.run.periodStart} to ${detail.run.periodEnd}`,
-	`  Total: ${terminalText(formatAssetAmount(detail.run.total))}; recipients: ${detail.run.recipientCount}`,
+	`  Total: ${terminalText(shownNumber(detail.run.total))} ${terminalText(assetName(detail.run.total.asset))}; recipients: ${detail.run.recipientCount}`,
 	`  Request key: ${terminalText(detail.command.requestKey)}`,
 	`  Command: ${terminalText(detail.command.commandId)}; state ${detail.command.state}; verification ${detail.command.verificationState}`,
 	...detail.command.completionOutcome === void 0 ? [] : [`  Recorded completion: ${detail.command.completionOutcome}`],
@@ -79332,7 +80016,7 @@ const runDetailLines = (detail) => [
 		`  Item ${item.itemIndex}: employee ${terminalText(item.employeeRef)}; engagement ${terminalText(item.engagementEdgeId)}`,
 		`    Gross: ${terminalText(item.gross)} raw units; net: ${terminalText(item.net)} raw units`,
 		...item.adjustments.map((adjustment) => `    Adjustment: ${terminalText(adjustment.label)}; ${terminalText(adjustment.amount)} raw units`),
-		`    Quantity: ${terminalText(item.amount.value)}; asset: ${terminalText(item.amount.asset)}`,
+		`    Quantity: ${terminalText(item.amount.value)}; asset: ${terminalText(assetName(item.amount.asset))}`,
 		`    Payment ${terminalText(item.payment.id)}: ${item.payment.status}`,
 		`    Counterparty: ${terminalText(item.payment.counterpartyLabel)}`,
 		`    Receipt: ${item.payment.receipt === null ? "none recorded" : `${terminalText(item.payment.receipt.transactionHash)} (chain ${item.payment.receipt.chainId})`}`,
@@ -79350,28 +80034,7 @@ const readValidatedRun = (config, input, validated, read) => Effect.gen(function
 	let command;
 	const runtime = yield* CliRuntime;
 	const known = () => orgId === null ? null : runRecovery(orgId, validated.runId, email, command);
-	const observed = yield* Effect.gen(function* () {
-		const restored = yield* restoreAuthenticatedClient(config, email, { requirement: "none" });
-		email = restored.session.email;
-		const organizations = yield* Effect.promise((signal) => restored.client.orgs({ signal })).pipe(Effect.flatMap(resultItems));
-		orgId = (yield* selectOrganization(organizations, orgId)).id;
-		if (!(yield* restored.stillAuthenticated)) return yield* Effect.fail(Errors.notAuthenticated());
-		const reading = read(restored.client.org(orgId).payroll, orgId, validated.runId, (value) => {
-			command = value.command;
-		});
-		const detail = yield* input.kind === "wait" ? withWaiting(reading, {
-			...runtime,
-			label: "Observe Payroll run state"
-		}) : reading;
-		if (detail === null) return yield* missingRun();
-		if (!matches(detail, orgId, validated.runId)) return yield* Effect.fail(mismatch());
-		if (!(yield* restored.stillAuthenticated)) return yield* Effect.fail(Errors.notAuthenticated());
-		command = detail.command;
-		return {
-			detail,
-			client: restored.client
-		};
-	}).pipe(Effect.mapError((error) => {
+	const guarded = (work) => work.pipe(Effect.mapError((error) => {
 		const failure = classifyFailure(Cause.fail(orgId === null ? error : normalizeOrganizationReadFailure(error, orgId)), `org.payroll.${input.kind}`);
 		const recovery = known();
 		return new CliFailure({
@@ -79391,7 +80054,33 @@ const readValidatedRun = (config, input, validated, read) => Effect.gen(function
 			...recovery.details,
 			message: recovery.lines
 		})}\n` : `${recovery.lines}\n`).pipe(Effect.ignoreCause);
-	}), Effect.timeoutOption(validated.timeout * 1e3));
+	}));
+	const { restored, selectedOrg } = yield* guarded(Effect.gen(function* () {
+		const session = yield* restoreAuthenticatedClient(config, email, { requirement: "none" });
+		email = session.session.email;
+		const organizations = yield* Effect.promise((signal) => session.client.orgs({ signal })).pipe(Effect.flatMap(resultItems));
+		const organization = yield* selectOrganization(organizations, orgId);
+		orgId = organization.id;
+		if (!(yield* session.stillAuthenticated)) return yield* Effect.fail(Errors.notAuthenticated());
+		return {
+			restored: session,
+			selectedOrg: organization.id
+		};
+	}));
+	const observed = yield* guarded(Effect.gen(function* () {
+		const reading = read(restored.client.org(selectedOrg).payroll, selectedOrg, validated.runId, (value) => {
+			command = value.command;
+		});
+		const detail = yield* input.kind === "wait" ? withWaiting(reading, {
+			...runtime,
+			label: "Observe Payroll run state"
+		}) : reading;
+		if (detail === null) return yield* missingRun();
+		if (!matches(detail, selectedOrg, validated.runId)) return yield* Effect.fail(mismatch());
+		if (!(yield* restored.stillAuthenticated)) return yield* Effect.fail(Errors.notAuthenticated());
+		command = detail.command;
+		return { detail };
+	})).pipe(Effect.timeoutOption(validated.timeout * 1e3));
 	if (Option.isNone(observed)) {
 		const recovery = known();
 		return yield* new CliFailure({
@@ -79528,6 +80217,11 @@ const continueRecoverySetup = (scoped, signal, onCurrent) => Effect.gen(function
 });
 //#endregion
 //#region src/commands/org/internal/progress.ts
+/** An epoch-ms time as a person reads it; a value no date can hold keeps its number. */
+const checkTime = (at) => {
+	const date = new Date(at);
+	return Number.isNaN(date.valueOf()) ? `${at} (Unix ms)` : date.toISOString();
+};
 /**
 * Organization lifecycle progress owned by one write command.
 *
@@ -79539,7 +80233,7 @@ const continueRecoverySetup = (scoped, signal, onCurrent) => Effect.gen(function
 * the signature. An interruption retains an ID that was already saved.
 */
 const asProgressError = (cause) => cause instanceof Error ? cause : new Error("Organization progress failed.", { cause });
-const makeOrganizationProgress = (mode, run, persist) => {
+const makeOrganizationProgress = (reader, run, persist) => {
 	const queued = [];
 	const held = [];
 	const heldSet = /* @__PURE__ */ new Set();
@@ -79554,7 +80248,7 @@ const makeOrganizationProgress = (mode, run, persist) => {
 		draining = draining.then(async () => {
 			while (queued.length > 0) {
 				const text = queued[0];
-				await run(writeStderr(text));
+				await run(writeProgress(reader, text));
 				queued.shift();
 			}
 			if (committed !== null && persisted !== committed) {
@@ -79603,14 +80297,14 @@ const makeOrganizationProgress = (mode, run, persist) => {
 		lastObserved = state;
 		const status = state.status;
 		return {
-			text: `${mode === "json" ? JSON.stringify({
+			text: `${reader.mode === "json" ? JSON.stringify({
 				type: "organization.lifecycle",
 				organizationId: committed,
 				status,
 				recovery: state.recovery,
 				reason: state.issue?.reason ?? null,
 				nextCheckAt: state.nextCheckAt
-			}) : `Organization ${JSON.stringify(committed)}: ${terminalText(status)}; recovery: ${terminalText(state.recovery)}${state.issue === null ? "" : `; reason: ${terminalText(state.issue.reason)}`}${state.nextCheckAt === null ? "" : `; next check: ${state.nextCheckAt}`}`}\n`,
+			}) : `Organization ${JSON.stringify(committed)}: ${terminalText(status)}; recovery: ${terminalText(state.recovery)}${state.issue === null ? "" : `; reason: ${terminalText(state.issue.reason)}`}${state.nextCheckAt === null ? "" : `; next check: ${checkTime(state.nextCheckAt)}`}`}\n`,
 			ready: status === "ready"
 		};
 	};
@@ -79709,7 +80403,7 @@ const execute$27 = (config, input) => Effect.gen(function* () {
 			handle: draft.handle,
 			organizationId: toOrgId(organizationId)
 		});
-		const progress = makeOrganizationProgress(runtime.mode, run, (organizationId) => run(persistRecovery(organizationId)));
+		const progress = makeOrganizationProgress(runtime, run, (organizationId) => run(persistRecovery(organizationId)));
 		yield* Effect.addFinalizer(() => Effect.promise(progress.flush).pipe(Effect.ignoreCause));
 		yield* Ref.set(progressRef, progress);
 		const flushProgress = Effect.gen(function* () {
@@ -79807,11 +80501,11 @@ const execute$27 = (config, input) => Effect.gen(function* () {
 //#endregion
 //#region src/commands/org/subcommands/create/command.ts
 const command$24 = Command.make("create", {
-	name: Flag.String("name"),
-	handle: Flag.String("handle"),
-	country: Flag.String("country"),
-	bio: Flag.String("bio").pipe(Flag.optional),
-	size: Flag.String("size").pipe(Flag.optional),
+	name: Flag.String("name").pipe(Flag.withDescription("the Organization's name, as people see it")),
+	handle: Flag.String("handle").pipe(Flag.withDescription("its @handle, written without the @ sign")),
+	country: Flag.String("country").pipe(Flag.withDescription("its country, as a two-letter code like GB")),
+	bio: Flag.String("bio").pipe(Flag.withDescription("a short description of the Organization"), Flag.optional),
+	size: Flag.String("size").pipe(Flag.withDescription("how big the Organization is, in your own words"), Flag.optional),
 	email: emailFlag$9,
 	confirm: confirmFlag$6,
 	timeoutSeconds: timeoutFlag$4
@@ -79989,7 +80683,7 @@ const execute$22 = (config, input) => Effect.gen(function* () {
 	return yield* withWaiting(Effect.gen(function* () {
 		const context = yield* Effect.context();
 		const run = Effect.runPromiseWith(context);
-		const progress = makeOrganizationProgress(waitingRuntime.mode, run, async () => void 0);
+		const progress = makeOrganizationProgress(waitingRuntime, run, async () => void 0);
 		yield* Effect.addFinalizer(() => Effect.promise(progress.flush).pipe(Effect.ignoreCause));
 		const deadline = new AbortController();
 		const openfortSignerFactory = yield* organizationWriteSigner(config, opened, run, async () => {
@@ -80094,7 +80788,7 @@ const follow = (client, scoped, organizationId, email, observed) => Effect.gen(f
 	const runtime = yield* CliRuntime;
 	return yield* withWaiting(Effect.gen(function* () {
 		const run = Effect.runPromiseWith(yield* Effect.context());
-		const progress = makeOrganizationProgress(runtime.mode, run, async () => void 0);
+		const progress = makeOrganizationProgress(runtime, run, async () => void 0);
 		yield* Effect.addFinalizer(() => Effect.promise(progress.flush).pipe(Effect.ignoreCause));
 		const lifecycle = yield* observeOrganizationSetup((listener, signal) => scoped.setup.subscribe(listener, { signal }), organizationId, null, async (value) => {
 			observed(value);
@@ -80147,8 +80841,10 @@ const org = Command.make("org").pipe(Command.annotate(CliCommandMetadata, metada
 //#endregion
 //#region src/commands/payment/subcommands/shared.ts
 const emailFlag = Flag.String("email").pipe(Flag.withDescription("the signed-in person to use, when this machine has several"), Flag.optional);
-const paymentIdArgument = Argument.String("id").pipe(Argument.withDescription("The Payment ID (wait also takes an approval ID)"));
-const timeoutFlag = Flag.Int("timeout-seconds").pipe(Flag.withDefault(120));
+const paymentIdArgument = Argument.String("id").pipe(Argument.withDescription("The Payment ID"));
+/** `payment wait` also follows the approval `payment send --json` returns. */
+const paymentOrApprovalIdArgument = Argument.String("id").pipe(Argument.withDescription("The Payment ID, or the approval ID from payment send"));
+const timeoutFlag = Flag.Int("timeout-seconds").pipe(Flag.withDescription("stop following after this many seconds (default: follow until it ends)"), Flag.optional);
 const sourceFlag = Flag.String("input").pipe(Flag.withDescription("the SDK payment JSON, from a file or - for stdin"), Flag.optional);
 const requestKeyFlag = Flag.String("request-key").pipe(Flag.withDescription("a key that makes repeating the same payment safe"), Flag.optional);
 const names = {
@@ -80362,7 +81058,7 @@ const timeoutFailure = (paymentId, email, organizationId) => {
 		code: "NETWORK_ERROR",
 		outcome: "failed",
 		exitCode: 5,
-		message: email === void 0 ? `The Payment wait stopped before session selection completed. The Payment state is unknown.\n${known.lines}` : `Payment settlement is not confirmed. The command stopped waiting. This Payment may still settle.\n${known.lines}`,
+		message: `Payment settlement is not confirmed. The command stopped waiting. This Payment may still settle.\n${known.lines}`,
 		details: known.details
 	});
 };
@@ -80439,31 +81135,29 @@ const observePayment = (register, paymentId, organizationId) => observeSnapshots
 		value: payment
 	});
 }).pipe(Effect.flatMap(resultValue), Effect.filterOrFail((payment) => payment !== null, paymentNotFound));
+/** `Option.none()` when `seconds` pass first. With no bound the wait follows the Payment until it ends. */
+const within = (seconds) => (work) => seconds === void 0 ? Effect.asSome(work) : Effect.timeoutOption(work, seconds * 1e3);
 const waitForPayment = (config, input, register, organizationId) => Effect.gen(function* () {
 	const paymentId = yield* readPaymentId(input.paymentId);
-	const timeoutSeconds = yield* readWriteTimeout(input.timeoutSeconds);
+	const timeoutSeconds = input.timeoutSeconds === void 0 ? void 0 : yield* readWriteTimeout(input.timeoutSeconds);
 	let email;
-	const observed = yield* Effect.gen(function* () {
-		const restored = yield* restoreAuthenticatedClient(config, input.email);
-		email = restored.session.email;
-		const runtime = yield* CliRuntime;
-		return {
-			payment: yield* withWaiting(observePayment((listener, signal) => register(restored.client, paymentId, listener, signal), paymentId, organizationId), {
-				...runtime,
-				label: "Observe Payment state"
-			}),
-			client: restored.client
-		};
-	}).pipe(Effect.mapError((error) => recoverFailure(error, paymentId, email, organizationId)), Effect.onInterrupt(() => Effect.gen(function* () {
+	const guarded = (work) => work.pipe(Effect.mapError((error) => recoverFailure(error, paymentId, email, organizationId)), Effect.onInterrupt(() => Effect.gen(function* () {
 		const runtime = yield* CliRuntime;
 		const known = recovery(paymentId, email, organizationId);
 		yield* writeStderr(runtime.mode === "json" ? `${JSON.stringify({
 			type: "payment.recovery",
 			...known.details
 		})}\n` : `${known.lines}\n`);
-	}).pipe(Effect.ignoreCause)), Effect.timeoutOption(timeoutSeconds * 1e3));
+	}).pipe(Effect.ignoreCause)));
+	const restored = yield* guarded(restoreAuthenticatedClient(config, input.email));
+	email = restored.session.email;
+	const runtime = yield* CliRuntime;
+	const observed = yield* guarded(withWaiting(observePayment((listener, signal) => register(restored.client, paymentId, listener, signal), paymentId, organizationId), {
+		...runtime,
+		label: "Observe Payment state"
+	})).pipe(within(timeoutSeconds));
 	if (Option.isNone(observed)) return yield* timeoutFailure(paymentId, email, organizationId);
-	const { payment } = observed.value;
+	const payment = observed.value;
 	return {
 		data: payment,
 		lines: [...paymentLines(payment), ...documentReferenceLines(payment)]
@@ -80473,7 +81167,7 @@ const waitForPayment = (config, input, register, organizationId) => Effect.gen(f
 //#region src/commands/org/subcommands/payment/subcommands/wait/execute.ts
 const execute$15 = (config, input) => Effect.gen(function* () {
 	const paymentId = yield* readPaymentId(input.paymentId);
-	const timeoutSeconds = yield* readWriteTimeout(input.timeoutSeconds);
+	const timeoutSeconds = input.timeoutSeconds === void 0 ? void 0 : yield* readWriteTimeout(input.timeoutSeconds);
 	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
 	const organizationId = yield* readOrganizationId(input.orgs);
 	return yield* waitForPayment(config, {
@@ -80495,16 +81189,16 @@ const isApprovalId = (id) => id.startsWith("approval_");
 */
 const waitForApproval = (config, input) => Effect.gen(function* () {
 	if (!APPROVAL_ID.test(input.approvalId)) return yield* inputRequired("Provide the approval ID: approval_ followed by 26 letters or digits.");
-	const timeoutSeconds = yield* readWriteTimeout(input.timeoutSeconds);
+	const timeoutSeconds = input.timeoutSeconds === void 0 ? void 0 : yield* readWriteTimeout(input.timeoutSeconds);
 	const runtime = yield* CliRuntime;
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
 	const human = runtime.mode === "human";
 	const outcome = yield* followApproval(client, input.approvalId, {
 		organizationId: input.organizationId,
-		deadlineMs: timeoutSeconds * 1e3,
-		onSigned: human ? progress("✓ Signed") : Effect.void
+		deadlineMs: timeoutSeconds === void 0 ? yield* followUntilLapseMs(client, input.approvalId) : timeoutSeconds * 1e3,
+		onSigned: human ? progress(runtime, "✓ Signed") : Effect.void
 	});
-	if (human) yield* progress("✓ Confirmed");
+	if (human) yield* progress(runtime, "✓ Confirmed");
 	return {
 		data: outcome,
 		lines: paidLines(outcome, input)
@@ -80516,33 +81210,38 @@ const execute$14 = (config, input) => waitForPayment(config, input, (client, pay
 //#endregion
 //#region src/commands/payment/subcommands/wait/command.ts
 const command$13 = Command.make("wait", {
-	paymentId: paymentIdArgument,
+	paymentId: paymentOrApprovalIdArgument,
 	email: emailFlag,
 	timeoutSeconds: timeoutFlag
-}, ({ paymentId, email, timeoutSeconds }) => dispatch("wait", {
-	personal: (config) => isApprovalId(paymentId) ? waitForApproval(config, {
-		approvalId: paymentId,
-		email: Option.getOrUndefined(email),
-		timeoutSeconds
-	}) : execute$14(config, {
-		kind: "wait",
-		paymentId,
-		email: Option.getOrUndefined(email),
-		timeoutSeconds
-	}),
-	organization: (config, orgId) => isApprovalId(paymentId) ? waitForApproval(config, {
-		approvalId: paymentId,
-		email: Option.getOrUndefined(email),
-		timeoutSeconds,
-		organizationId: orgId
-	}) : execute$15(config, {
-		kind: "wait",
-		orgs: [orgId],
-		paymentId,
-		email: Option.getOrUndefined(email),
-		timeoutSeconds
-	})
-})).pipe(annotate("wait"), Command.withDescription("Follow a Payment, or an approval ID from payment send, until it ends"));
+}, (flags) => {
+	const { paymentId } = flags;
+	const email = Option.getOrUndefined(flags.email);
+	const timeoutSeconds = Option.getOrUndefined(flags.timeoutSeconds);
+	return dispatch("wait", {
+		personal: (config) => isApprovalId(paymentId) ? waitForApproval(config, {
+			approvalId: paymentId,
+			email,
+			timeoutSeconds
+		}) : execute$14(config, {
+			kind: "wait",
+			paymentId,
+			email,
+			timeoutSeconds
+		}),
+		organization: (config, orgId) => isApprovalId(paymentId) ? waitForApproval(config, {
+			approvalId: paymentId,
+			email,
+			timeoutSeconds,
+			organizationId: orgId
+		}) : execute$15(config, {
+			kind: "wait",
+			orgs: [orgId],
+			paymentId,
+			email,
+			timeoutSeconds
+		})
+	});
+}).pipe(annotate("wait"), Command.withDescription("Follow a Payment, or an approval ID from payment send, until it ends"));
 //#endregion
 //#region src/commands/payment/internal/send-input.ts
 const LIMIT$1 = 65536;
@@ -80596,8 +81295,9 @@ const parsePaymentInput = (value) => Effect.gen(function* () {
 	if (typeof rawValue !== "string") return yield* invalid$2();
 	const assetId = Object.values(TOKENS.BASE_SEPOLIA).find((id) => id === amountInput.asset);
 	if (assetId === void 0) return yield* inputRequired("Provide an admitted Base Sepolia asset ID.");
-	const amount = parseAssetAmount(rawValue, requireAsset(assetId));
-	if (isMoneyParseError(amount)) return yield* inputRequired(`Provide a positive exact amount (${amount.reason}).`);
+	const metadata = requireAsset(assetId);
+	const amount = parseAssetAmount(rawValue, metadata);
+	if (isMoneyParseError(amount)) return yield* inputRequired(amountRefusal(amount.reason, metadata), { field: "amount" });
 	if (value.paymentType !== void 0 && value.paymentType !== "unspecified" && value.paymentType !== "invoice" && value.paymentType !== "reimbursement") return yield* inputRequired("Provide a supported --payment-type.");
 	if (value.timing !== void 0 && (!record$1(value.timing) || !keysOnly(value.timing, ["kind"]) || value.timing.kind !== "instant")) return yield* inputRequired("Only instant Payment timing is supported.");
 	return {
@@ -80712,6 +81412,7 @@ const readPaymentInput = (source) => Effect.gen(function* () {
 /** The checks every send makes before a client: one source of the payment, the key and the follow time. */
 const readSendFlags = (input) => Effect.gen(function* () {
 	if (input.source !== void 0 && (input.to !== void 0 || input.amount !== void 0)) return yield* inputRequired("Use <to> <amount> or --input, not both.");
+	if (input.to !== void 0) yield* readRecipient$1(input.to);
 	return {
 		requestKey: input.requestKey === void 0 ? void 0 : yield* readRequestKey(input.requestKey),
 		timeoutSeconds: input.timeoutSeconds === void 0 ? void 0 : yield* readWriteTimeout(input.timeoutSeconds)
@@ -80739,7 +81440,7 @@ const execute$13 = (config, input) => Effect.gen(function* () {
 	const approval = yield* withWaiting(Effect.promise((signal) => client.approvals.prepare({
 		...payment,
 		...flags.requestKey === void 0 ? {} : { requestKey: flags.requestKey }
-	}, { signal })).pipe(Effect.flatMap(resultValue)), {
+	}, { signal })).pipe(Effect.flatMap(resultValue), Effect.mapError(namingRecipient(payment.to))), {
 		...runtime,
 		label: "Preparing the payment"
 	});
@@ -80868,7 +81569,7 @@ const execute$12 = (config, orgId, input) => Effect.gen(function* () {
 		organizationId: orgId,
 		permissionId: String(budget.id),
 		...flags.requestKey === void 0 ? {} : { requestKey: flags.requestKey }
-	}, { signal })).pipe(Effect.flatMap(resultValue)), {
+	}, { signal })).pipe(Effect.flatMap(resultValue), Effect.mapError(namingRecipient(payment.to))), {
 		...runtime,
 		label: "Preparing the payment"
 	});
@@ -81231,33 +81932,29 @@ const execute$6 = (config, input) => Effect.gen(function* () {
 	const actor = orgId === null ? client.account : client.org(orgId);
 	const stored = yield* Effect.promise((signal) => actor.requests.issue(draft, { signal })).pipe(Effect.flatMap(resultValue), Effect.mapError((error) => requestWriteFailure(error, orgId, "issued", null, session.email)));
 	const item = requestCheckout(stored, config.checkoutFrontendOrigin);
-	const documents = yield* savePaymentDocuments(config, client, item, input.outputDirectory);
 	return {
 		data: {
 			scope: scopeValue(orgId),
 			direction: input.direction,
-			item,
-			documents
+			item
 		},
-		lines: [...requestLines(item, session.email, orgId), ...documentOutputLines(documents)]
+		lines: requestLines(item, session.email, orgId)
 	};
 });
 //#endregion
 //#region src/commands/request/subcommands/issue/command.ts
 const command$6 = (context) => Command.make("issue", {
 	email: emailFlag$3,
-	source: Flag.String("input"),
-	confirm: confirmFlag$2,
-	outputDirectory: Flag.String("output-dir").pipe(Flag.optional)
-}, ({ email, source, confirm, outputDirectory }) => context.dispatch("issue", (scope) => ({
+	source: Flag.String("input").pipe(Flag.withDescription("the request JSON, from a file or - for stdin")),
+	confirm: confirmFlag$2
+}, ({ email, source, confirm }) => context.dispatch("issue", (scope) => ({
 	kind: "issue",
 	...scope,
 	direction: context.direction,
 	source,
 	confirm,
-	email: Option.getOrUndefined(email),
-	outputDirectory: Option.getOrUndefined(outputDirectory)
-}), execute$6)).pipe(context.annotate("issue"), Command.withDescription("Issue a payment request and save its available PDFs"));
+	email: Option.getOrUndefined(email)
+}), execute$6)).pipe(context.annotate("issue"), Command.withDescription("Issue a payment request"));
 //#endregion
 //#region src/commands/request/subcommands/pay/execute.ts
 const command$5 = (args) => args.map(shellArgument).join(" ");
@@ -81363,12 +82060,7 @@ const inbox = Command.make("inbox").pipe(received.annotate("root"), Command.with
 //#endregion
 //#region src/commands/schema/internal/contract.ts
 /** Commands that move money. Each one hands over to the approval page. */
-const MONEY = /* @__PURE__ */ new Set([
-	"payment.send",
-	"payment.retry",
-	"inbox.pay",
-	"org.payroll.run"
-]);
+const MONEY = new Set(Object.keys(MONEY_RESULTS));
 /** Commands that answer from this machine alone. */
 const LOCAL = /* @__PURE__ */ new Set([
 	"whoami",
@@ -81380,7 +82072,9 @@ const LOCAL = /* @__PURE__ */ new Set([
 	"schema"
 ]);
 /** A money command's `data`: the approval link for an agent, the outcome for a person. */
-const APPROVAL = "--json: { status: 'awaiting_approval', approvalId, approvalUrl, paymentIds, expiresAt, next: { argv } }; a person: ApprovalOutcome { approval, payments }";
+const APPROVAL = "--json: { status: 'awaiting_approval', approvalId, approvalUrl, paymentIds, expiresAt, next: { argv } }; a person: ApprovalOutcome { approval, payments }. It saves no PDF: `capxul document render` does";
+/** `data` of an Organization Permission write: what was submitted, and with `--wait` where the command ended. */
+const PERMISSION_WRITE = "{ execution, requestKey }; with --wait also command: PermissionCommandView (status applied, failed or actionable)";
 /** `data` of the commands an agent reaches for most; other lists are pages, others the SDK value. */
 const OUTPUT = {
 	home: "{ where, signedIn, balances: Account | null, needsYou: NeedsYou[] | null, try }",
@@ -81394,6 +82088,12 @@ const OUTPUT = {
 	"payment.retry": APPROVAL,
 	"inbox.pay": APPROVAL,
 	"org.payroll.run": APPROVAL,
+	"request.issue": "{ scope, direction, item: ActorRequest & { checkoutUrl } }. It saves no PDF: `capxul document render` does",
+	"org.permission.create": PERMISSION_WRITE,
+	"org.permission.change": PERMISSION_WRITE,
+	"org.permission.assign": PERMISSION_WRITE,
+	"org.permission.revoke": PERMISSION_WRITE,
+	"org.permission.replace": PERMISSION_WRITE,
 	[CAPXUL_OPERATIONS.inbox.list]: "Page<InboxItem>",
 	"inbox.get": "InboxItem",
 	"request.list": "Page<ActorRequest>",
@@ -81456,15 +82156,6 @@ const EXIT_CODES = {
 	130: "cancelled: interrupted, or rejected on the approval page"
 };
 //#endregion
-//#region src/runtime/root-command.ts
-/** The command tree `capxul` runs, for the commands that describe it (`capxul schema`). */
-var RootCommand = class extends Context.Service()("capxul-cli/RootCommand") {};
-/**
-* The tree, when the entry provided it. Reading it as optional keeps it out of
-* every command's requirements; only `schema` asks, and the entry always gives it.
-*/
-const rootCommand = Effect.flatMap(Effect.serviceOption(RootCommand), (root) => Option.isSome(root) ? Effect.succeed(root.value) : Effect.die("RootCommand is not provided"));
-//#endregion
 //#region src/commands/schema/internal/describe.ts
 const flagOf = (flag) => ({
 	name: `--${flag.name}`,
@@ -81644,7 +82335,14 @@ const execute$2 = (config, wanted) => Effect.gen(function* () {
 	});
 	const handle = wanted.replace(/^@/u, "").toLowerCase();
 	const organization = organizations.find((candidate) => candidate.handle.toLowerCase() === handle || candidate.id === wanted);
-	if (organization === void 0) return yield* inputRequired(`You are not a member of an Organization "${terminalText(wanted)}". See yours with: capxul org list`);
+	if (organization === void 0) return yield* inputRequired(`You are not a member of an Organization "${terminalText(wanted)}". See yours with: capxul org list`, {
+		field: "handle",
+		next: [
+			"capxul",
+			"org",
+			"list"
+		]
+	});
 	const saved = {
 		id: organization.id,
 		handle: organization.handle,
@@ -82285,6 +82983,15 @@ const completionFailure = (error) => {
 	if (error._tag === "ShowHelp") return error.errors.some(completionFailure);
 	return (error._tag === "InvalidValue" || error._tag === "MissingOption" || error._tag === "DuplicateOption") && (error.option === "completions" || error.option === "--completions");
 };
+const helpFlag = (arg) => arg === "--help" || arg === "-h";
+const unknownSubcommand = (error) => error._tag === "UnknownSubcommand" || error._tag === "ShowHelp" && error.errors.some((cause) => cause._tag === "UnknownSubcommand");
+/**
+* The refusal for an unknown command in a line that asks for help: `capxul
+* nonsense --help` would print the parent's help and exit 0. The line is
+* parsed without its help flag, and an unknown command refuses as it does
+* without one.
+*/
+const unknownCommandUnderHelp = (args, parse) => args.some(helpFlag) ? Effect.map(parse(args.filter((arg) => !helpFlag(arg))), (parsed) => Result.isFailure(parsed) && unknownSubcommand(parsed.failure) ? parsed.failure : void 0) : Effect.undefined;
 /** Help shown only because required options or arguments were missing. */
 const missingParameters = (error) => CliError.isCliError(error) && error._tag === "ShowHelp" && error.errors.length > 0 && error.errors.every((cause) => cause._tag === "MissingOption" || cause._tag === "MissingArgument");
 /**
@@ -82333,7 +83040,7 @@ const reportNativeFailure = (input) => Effect.gen(function* () {
 		}
 	}
 	const invocation = yield* Ref.get(current);
-	const failure = classifyFailure(cause, invocation?.command ?? parsedCommand(cause), runtime.args);
+	const failure = classifyFailure(cause, invocation?.command ?? parsedCommand(cause), runtime.args, pathKind(command));
 	yield* renderResult(mode, failureEnvelope(failure, invocation?.command ?? parsedCommand(cause), invocation?.kind === "command" ? invocation.invocationId : null));
 	return failure.exitCode;
 });
@@ -82456,7 +83163,8 @@ const runCli = (platform) => Effect.uninterruptibleMask((restore) => Effect.gen(
 		})))
 	});
 	const builtIns = cliConfig.builtIns.filter((flag) => interactive && !ci && mode === "human" || flag !== GlobalFlag.Wizard).map((flag) => flag === GlobalFlag.Help ? decorate(GlobalFlag.Help, "help") : flag === GlobalFlag.Version ? decorate(GlobalFlag.Version, "version") : flag === GlobalFlag.Completions ? decorate(GlobalFlag.Completions, "completion") : flag === GlobalFlag.Wizard ? wizard : flag);
-	const nativeExit = yield* restore(runNative(homeInvocation(args)).pipe(Effect.catch((error) => Effect.gen(function* () {
+	const unknownCommand = yield* unknownCommandUnderHelp(args, (rest) => parseProbe(homeInvocation(rest)).pipe(Effect.provideService(Console.Console, captureConsole)));
+	const nativeExit = yield* restore((unknownCommand ? Effect.fail(unknownCommand) : runNative(homeInvocation(args))).pipe(Effect.catch((error) => Effect.gen(function* () {
 		if (!interactive || ci || mode !== "human" || !missingParameters(error) || (yield* Ref.get(current)) !== null) return yield* Effect.fail(error);
 		const leaf = commandAtPath(command, error.commandPath);
 		if (leaf === void 0 || leaf.subcommands.length > 0) return yield* error;
@@ -82488,4 +83196,4 @@ const runCli = (platform) => Effect.uninterruptibleMask((restore) => Effect.gen(
 //#endregion
 export { runCli };
 
-//# sourceMappingURL=entry-GLdITgH4.mjs.map
+//# sourceMappingURL=entry-DXu0dr0S.mjs.map